1. A microprocessor comprising: an instruction-processing pipeline; a processor bus; a cache memory hierarchy; and a secure memory, inaccessible via the processor bus and not part of the cache memory hierarchy, configured to store cryptographic keys; wherein the microprocessor is configured to restrict access to the secure memory by preventing a non-privileged program from reading or writing cryptographic key values to or from the secure memory; wherein the microprocessor is further configured to: receive a request to switch from a normal execution mode in which encrypted instructions cannot be executed, into a secure execution mode (SEM), in which they can; conditionally grant the request; execute an instruction to write a set of one or more cryptographic key values into a secure memory of the microprocessor; fetch an encrypted program from an instruction cache; and decrypt the encrypted program into plaintext instructions using decryption logic within the instruction-processing pipeline, the decryption logic using cryptographic key values stored in the secure memory, or one or more derivatives thereof, to decrypt the encrypted program; and execute the program without exposing the plaintext instructions to any non-privileged program or to any resources external to the microprocessor.