How is SGX different from putting a sticker on the server rack door that says "don't open private data"? Just asking.
Except, of course, if you put malware in the next build of your mobile app, and grab it before it's encrypted. Which Signal easily could, and it probably wouldn't be spotted for weeks. Fundamentally, it's all about trusting other people.