To repeat an earlier comment, this scheme encourages a centralization of trust into a private key managed by processor manufacturers. You might say that by integrating SGX mechanisms into your security model, you create a set of 'feudal lords' [1] who can wield their power over you.
A manufacturer may 'legitimately' establish an enclave in your most trusted hardware which you may not audit or even measure. And if that security model becomes commonplace, for example when only allowing Widevine DRM inside SGX, you eventually cannot use your self-chosen hardware, but will have to pick a feudal lord from a limited set of 'ecosystem choices'.
A manufacturer may 'legitimately' establish an enclave in your most trusted hardware which you may not audit or even measure. And if that security model becomes commonplace, for example when only allowing Widevine DRM inside SGX, you eventually cannot use your self-chosen hardware, but will have to pick a feudal lord from a limited set of 'ecosystem choices'.
[1] https://www.schneier.com/blog/archives/2013/06/more_on_feuda...