It doesn't say a word about running inside SGX without the insecure developer mode... or about the use of SGX meaning they're stuck with hardware which has the highly questionable ME layer.

SGX as an additive layer for things you can't make strongly private is interesting... though I wonder if it wouldn't have first made sense to implement a private intersection so that signal users wouldn't have to send numbers that are guaranteed to have no hits.