> Or the mistake is that we're running different trust domains on the same CPU core.

It's very hard to not make that mistake. Think of all the websites running in your browser on your laptop. Isolating all those trust domains is going to be quite costly.