SGX that, as a user, you can't even verify is in use. I really don't know why they're focusing on things like this. It does nothing to increase evidence-based

SGX that, as a user, you can't even verify is in use. I really don't know why they're focusing on things like this. It does nothing to increase evidence-based trust, so it's no better than saying "we added a rate limiter, and delete keys after X attempts" (which I'd be totally fine with, and they could probably put in place in practically no time). Either way you're still relying on them doing what they said they're doing.