I am pessimistic about SGX. It's basically a DRM system that was dressed up to look like something else. Even if one trusts Intel, the entire security model hinges on Intel's ability to detect a compromised key and revoke it; that makes plenty of sense for DRM, where compromised keys are typically announced on forums etc., but why would a service operator or government agency tell anyone?

Moxie has good ideas, but SGX is a trap and he fell into it.