Secure enclave, pcc, etc are things that get submitted for independent auditing and certification. At least for some stuff.