It claims to do this using SGX. However, it uses a "Relay" - a non-SGX process - to pass network data into the SGX enclave.

To me that seems to make the claim of trustworthiness (in the "trustworthy computing" sense) questionable.

I'm not overly familiar with SGX and I've only scanned through this proposal, but I'd love someone more knowledgeable to expand my understanding.

It seems to me that the entire stack needs to be running in the SGX-enclave for it to gain the complete benefits?

Nevertheless, I think this is pretty interesting.