They could potentially extend SGX type mechanism to execute more complex data operators within an enclave and give out only results that are at least k-anonymou

They could potentially extend SGX type mechanism to execute more complex data operators within an enclave and give out only results that are at least k-anonymous or allow decrypted results only if it is explicitly allowed when enclave is created. And of course all this has to be implemented in an isolated hardware so that classic chip timing/race attacks cannot steal secrets like it is possible from within the enclaves with SGX today.