By "they", I mean services that advertise private AI inference running in confidential computing environments like Intel SGX/TDX.

My point is: I've seen arguments that RAM interposition showcased in tee.fail would probably be too obvious in a reputable data center, but you can seemingly just extract a key through a physical attack once and pretend to be that CPU in software thereafter.[1]

I'm not very knowledgeable in this topic, but how are users of this service meant to verify that the TDX verifications quotes aren't forged from a key extracted from a processor as seen in tee.fail?

[1] https://tee.fail/#:~:text=Recovering%20Attestation%20Keys%20from%20Intel%20Machines