If you can’t offer a feature like this in a secure manner then you shouldn’t offer the feature at all.

Why not? "At scale" is not an argument on its own. This is something where scale helps you because the number of different hardware you need to support is independent from the size of your customer base.

And if you really can't act responsibly "at scale" then you shouldn't be allowed that scale.