SGX’s per-chip private keys are the “flag” in Intel’s unintentional CPU vulnerability CTF.

Those keys have been popped so many times.

Reading the original they explicitly state that side channels are out of scope for their threat model. As a result, designed a system that was essentially maximally vulnerable to side-channels (and other architectural issues). It’s really hard to trust SGX as a result. Otoh, if I were in a bind and needed to do trusted computation on an untrusted host, are there really other options that don’t suffer similar (or worse) issues?