I think it makes sense in very narrow use cases such as hardware security modules for key management, giving the user a somewhat strong guarantee that there is

I think it makes sense in very narrow use cases such as hardware security modules for key management, giving the user a somewhat strong guarantee that there is a one-to-one correspondence between control of the key and physical ownership of the HSM. This is an example where limitations of what you can do with the hardware is the primary feature of the hardware and the reason the user acquired it in the first place. It is analogous to physical locks being hard to pick by design. Any use of enclaves for DRM are unethical though, and solutions such as Play Integrity API is a commingling of security guarantees and totalitarian control over the user. Instead of proving to a service provider (such as your bank) that your whole phone is running a verified software and hardware stack, it suffices to communicate with a HSM with which you verify that the transaction to be authorized (1) comes from your bank, and (2) has a description which aligns with what you expect. The HSM can be built into the phone or be an external device with a small screen, but it should never ever enforce how you use the rest of the phone, it should only solve the narrow security issue of authorizing critical transactions.