This makes sense for enterprise use cases, but then the soc manufacturer shouldn't be able to do this as well.. otherwise customers still need to trust the manufacturer.

So I was referring to the case where there exists an entity that has some equivalent of "private keys" that makes it possible to control the TEE/attestation..