‘.. [Intel Software Guard Extensions (SGX)] is what supposed to be secure inside Intel ships" [but, it turns out it's] really porous. You can see right through this thing."’

Have a second system that boots and secures the rest of the computer and then switches itself off. As in there is no combination of instructions that can access this second system. A bit like the Intel ME except it's actually secure from remote activation.