Now I'm curious, how do TDX enclaves get secure time and prevent rollback attacks on the VM? NTPS? Where's the secure counter you'd need to stop the disk image being rolled back? A lot of the attacks I discovered on SGX (the concept, not the implementation) were to do with the adversarial operator being able to roll back and replay inputs to the enclave. For example, you couldn't use a password to protect anything, because the enclave couldn't detect brute force attacks as it had no reliable forward sense of time.
Absolutely agreed that downgrade attacks are a real problem, though TPMs can easily mitigate this by using their monotonic counter functions.
Still, secure time is useful for many things. There are a lot of network protocol approaches to secure time, but for applications where it really matters where you cannot trust GPS, atomic clock PCI cards are in the low thousands of dollars now.
