I created Mojo-V.

There's no back doors, but there's no integrity checking either, so a Mojo-V voting machine could take an encrypted vote and throw it away and add +1 to the attacker's favorite candidate.

A computational integrity checking mechanism will appear soon that will add a concise proof to every encrypted Mojo-V value, that will prove to the data owner that their requested computation was faithfully performed. And the mechanism also supports safe disclosures, too.

This should give data owners strong controls over what can be done with their data

By backdoor, I meant the capability to implement one.

The OEM looking for greater controls on their platform, would be considered the "data owner", here.

There's no real way to prevent that.

The platform owner can manage keys and data contracts in the processor, that should enable them to rotate secrets constantly.

In other hardware there is an OEM secret because the manufacturer is trying to keep users out of "their hardware", in this case we're trying to keep everyone except the data owner out.