I hope we can fix this with sandboxing (maybe with containers, but maybe just per-process).

This is going to be the most exciting thing about SGX, which is allegedly coming out in a month, after many many years of anticipation.