> A primary point of SGX is confidentiality: the host OS can’t map and read enclave pages because the contents are encrypted and the hardware will generate an e

> A primary point of SGX is confidentiality: the host OS can’t map and read enclave pages because the contents are encrypted and the hardware will generate an exception on any attempt. In other words, your data is confidential from even the infrastructure operator. You're still trusting Intel to truthfully verify attestation. Intel could lie about this. Ultimately you're trusting the vendor implementing the environment and providing the attestations to behave as they claim, independent of the technical characteristics of the environment. But in terms of the technical characteristics, it seems far easier to mitigate side channels in an environment like EC2 than SGX. And that's what I based my opinion on.