Exactly. And the main limitation of this approach is that it's really hard to prevent breaking a single cpu from being a class break. You manage with glitches

Exactly. And the main limitation of this approach is that it's really hard to prevent breaking a single cpu from being a class break. You manage with glitches or side channels (e.g. spectre for sgx) to steal the per cpu secrets, and then you setup an emulator that can obtain intel attestation, then suddenly any application that depends on the impossibility of an emulator faking that attestation is broken. It's even harder for these DRM-focused SGX like solutions because they really need the attestation to be anonymous to avoid it being a massive tracking vector and privacy breach... while a more traditional hsm attestation would still identify the device and potentially allow limiting the impact of compromising a single one.