SGX is supposed to be able to hide stuff from root.

Extending the other answer, root on eg a hypervisor guest also shouldn't give you access to secrets hidden from even the bare-metal root account.