Spot on. If the key never touches a TEE, you rekeyed in userspace. That's just a hot wallet with extra steps. Inspect the syscall trace to be sure.
trace is fine for an audit. in production, i assume anything on a networked board is hot. the tee is just a smaller target, not a bunker. complexity is the real leak
1