> It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source.

If the attestation signature matches the published enclave code, then we can know if there's a match. So either there's a missing mitigation, which no one ever has complained about, or the running enclave code doesn't match the source, which also no one ever has complained about. Without independent audit, there is no verification and we have established that independent parties do not care.

> Only private contact discovery depends on trusting SGX.

uh, no. this is demonstrably and obviously wrong.