This is in-fact the precise use case of secure enclave remote attestation. Maybe the GCHQ will be able to run their own Reddit clients, but the average person or even experienced hacker will not.