One of the major elements of a TEE is that I can send code to an untrusted party and expect it to be executed faithfully. Under that model I have to assume that

One of the major elements of a TEE is that I can send code to an untrusted party and expect it to be executed faithfully. Under that model I have to assume that they have physical access to their own hardware and could do hardware based attacks. Which means the model is just as broken even without it being a software attack.