The operators own the hardware and lease it to customers for computation. Those customers do not trust the operators to not peek at their Super Sensitive Data. TEE is a way for the operator to provide assurances to their customers that they will not, and more importantly cannot, exfiltrate customer data.
This is in theory. In practice, as demonstrated by the article, these assurances are not bulletproof.
This makes sense for enterprise use cases, but then the soc manufacturer shouldn't be able to do this as well.. otherwise customers still need to trust the manufacturer.
So I was referring to the case where there exists an entity that has some equivalent of "private keys" that makes it possible to control the TEE/attestation..
