I'm sorry to say that I am not convinced. In recent years, Microsoft has introduced [Virtualisation-based Security](https://learn.microsoft.com/en-us/windows-ha

I'm sorry to say that I am not convinced. In recent years, Microsoft has introduced [Virtualisation-based Security](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://learn.microsoft.com/en-us/windows-hardware/design/de...) - funnily enough while recycling one of actual security experts' most-loathed acronym, "VBS" - for OS components that are deemed critical, such as Windows Defender Credential Guard. If your OS, that is now also a hypervisor, shards off some "critical" computation, such as computing RA-TLS nonces - into a privileged domain that your regular user domain may not access, and that privileged, TMP-attested domain is protected by all the secure/measured boot shenanigans that are going on with Windows 11 and its mandatory TPM, it's as game over as it was with SGX directly in your CPU (barring some grave implementation bugs that will make everything vulnerable to state-level actors regardless). Also, Arm silicon, for example, has TrustZone, which afaiui serves a similar purpose as SGX did.