I would think a more reliable method would be heuristics to detect tampering which triggers enclave destruction when confidence level is high or the activity co

I would think a more reliable method would be heuristics to detect tampering which triggers enclave destruction when confidence level is high or the activity continues long enough. There are exceptions but the actions that enable deeper exploits rarely resemble normal usage in any way and should be simple to differentiate.