How does this ensure that the code on the server is running on the secure enclave, and not in an emulation[2]? Or that the whole attestation is not emulated? Ho

How does this ensure that the code on the server is running on the secure enclave, and not in an emulation[2]? Or that the whole attestation is not emulated? How do we know that the team who built the SGX does not work closely with the NSA[1]? I would probably just concatenate the phone numbers with the user's numbers, throw in some hard to guess salt like the Dow Jones index, and hash it with bcrypt. It's not perfect, but I would consider it good enough. And most importantly, easier for me to verify. ([1] Only half kidding: My favorite paranoid theory is that most security tech is thoroughly backdoored, and most of the 30000-40000 employees of NSA are actually doing parallel contruction all day long for the data they get this way.) [2] Edit: from skimming the previous HN discussion, it seems that SGX relies upon Intel's remote attestation service. The code you run is signed by Intel, and you have a chain of trust stemming from a key held by Intel. It's a clever construction, but I still feel it is too clever to be comfortable with.