There's a feature provided by a fair number of flash chips called a "Replay Protected Memory Block" or RPMB. The idea is that you provision your flash chip with a secret shared only with the secure enclave (presumably stored on fuses in the secure enclave) and then you can use that key to read and write a small block of storage on the flash chip.

It's "replay protected" because the crypto prevents an attacker from replaying old contents of the chip back to the secure element.

If Intel ever stopped mucking around with SGX licensing policy, SGX + RPMB would be a really nice combination on laptops.