You could do attested code in an enclave, which though vulnerable to certain side channels, is probably more robust than the standard case.