When the enclave boots, two things happen:

1. An HPKE (https://www.rfc-editor.org/rfc/rfc9180.html ) key is generated. This is the key that encrypts communication to the model.

2. The enclave is provisioned a certificate

The certificate is embedded with the HPKE key accessible only inside the enclave. The code for all this is open source and part of the measurement that is being checked against by the client.

So if the provider attempts to send a different attestation or even route to a different enclave, this client side check would fail.