That's... slightly better? I think? Honestly SGX is complicated enough that I'm not entirely sure I have this straight. Am I correct in thinking that: 1. A use

That's... slightly better? I think? Honestly SGX is complicated enough that I'm not entirely sure I have this straight. Am I correct in thinking that: 1. A user-programmable MSR would allow the device owner to falsify the attestation of enclave initialization (when using their own keys). 2. The ME (and other firmware) would still not be replaceable or owner controllable. 3. Due to 2, enclave compromise would have to be premeditated. That is, once an enclave is up and running IIUC it can (potentially) use MRENCLAVE to derive the sealing key. Without control of the ME that enclave would be unbreachable, correct? So realistically, to maintain control of code running on my device I would have to set my own SGX keys and configure my system to actively compromise all enclaves at launch. From a security standpoint, there's still a black box (the ME) with super-root that could be compromised by attackers that I can't inspect, modify, or disable. And from a political standpoint, there's still a tragedy of the commons regarding DRM if the majority of providers decide to require SGX with Intel root keys as a condition of service. Have I misunderstood anything? (While responding, I stumbled across an interesting paper regarding using SGX to protect malware against researchers: https://arxiv.org/abs/1902.03256 https://arxiv.org/abs/1902.03256) Edit: It appears I was overly optimistic - playback of 4k BluRay already requires Intel SGX. (https://old.reddit.com/r/Amd/comments/bw0cwq/will_ryzen_3rd_gen_finally_support_4k_bluray https://old.reddit.com/r/Amd/comments/bw0cwq/will_ryzen_3rd_...)