1. A microprocessor comprising: an instruction-processing pipeline including a fetch unit and an execution unit; a processor bus; a cache memory hierarchy; and a secure memory, inaccessible via the processor bus and not part of the cache memory hierarchy, configured to store cryptographic keys; wherein the microprocessor is configured to restrict access to the secure memory by preventing a non-privileged program from reading or writing cryptographic key values to or from the secure memory; wherein the microprocessor is further configured to: receive a request to switch from a normal execution mode in which encrypted instructions are unable to be executed, into a secure execution mode (SEM), in which they are able to be executed; conditionally grant the request to switch into the SEM on the basis of whether the request is in the form of an instruction carrying an encrypted parameter, the instruction is part of a privileged program or process, and the encrypted parameter, when decrypted, meets a predetermined criterion for running an encrypted program; execute an instruction to write a set of one or more cryptographic key values into a secure memory of the microprocessor; fetch encrypted instructions of the encrypted program from an instruction cache into the fetch unit; and within the fetch unit, decrypt the encrypted instructions of the encrypted program into plaintext instructions using decryption logic within the instruction-processing pipeline, the decryption logic using cryptographic key values stored in the secure memory, or one or more derivatives thereof, to decrypt the encrypted program; and execute the plaintext instructions as other encrypted instructions of the encrypted program are fetched, without storing the plaintext instructions prior to their execution and without exposing the plaintext instructions to any non-privileged program or to any resources external to the microprocessor.