> One might argue that it is not always true that the adversary can program different keys into the NVM on a training device, for instance, when one-time programmable (OTP) memories like e-fuses or ROMs are used. We admit that such keys cannot be extracted using our approach.

The SGX remote attestation key is burnt into the chip during manufacture and isn’t programmable.