In principle you can do the same thing of having keys in a secure enclave that can only be accessed if the bootloader and OS were signed with an appropriate key

In principle you can do the same thing of having keys in a secure enclave that can only be accessed if the bootloader and OS were signed with an appropriate key and not revoked. In practice there would certainly be a larger attack surface because you've now got n different hardware secure enclaves, n different bootloaders, and n different OS implementations, and a flaw in any one of them is potentially all that an attacker needs. Would you allow apple to apply a high standard and e.g. blacklist manufacturers who repeatedly had holes in their implementation? Would you trust Huawei's implementation to not have a hidden backdoor accessible only to the Chinese state and not discoverable otherwise? (Do you trust Apple's implementation to not have the same for the US/Israel?)