Interesting- searching says you're right. I thought the enclave discarded the derived decryption keys in those situations. Looks like it just goes extra locked down.