The attacker's assumed capability is arbitrary execution locally. Assuming an attacker is running as a separate user from the secret they want to steal (reason

The attacker's assumed capability is arbitrary execution locally. Assuming an attacker is running as a separate user from the secret they want to steal (reasonable assumption, in my opinion) they need a vulnerability in the kernel, or some service running as root. Probably the kernel. SGX pushes that further - you need a vulnerability in the hardware. The attack surface of your hardware is < the attack surface of your hardware + kernel, so it seems like a win. We'll continue to see attacks against hardware, but this is still a technology worth exploring.