The theory is that when you send your contact list to the service, the service can prove to you that it's running a specified set-intersection application (and

The theory is that when you send your contact list to the service, the service can prove to you that it's running a specified set-intersection application (and nothing else!) in the environment that will have access to that data, using this attestation mechanism. If it modified the application to make it log or leak your data somehow, it could no longer pass that attestation step. This should work as long as there is no hardware or side channel attack that lets the service operator (or someone it rents hardware from) defeat the SGX security guarantees, as long as there's no backdoor in the enclave implementation, and as long as the signing keys are not leaked or extracted, and are only used in accordance with the published policies.