To support failover you can copy the keys from one TEE to another in a secure manner such that they still cannot leave an equivalent TEE running the same software. The issue of course is if the operator can replay withdraws across the TEEs.