If you have physical access, you can pretty much get anything you want out of the CPU. Particularly if you have a semiconductor test lab. Here's a quick, incomplete list, of how to get data out.
JTAG: JTAG is the simplest method as it does not require you have any specialized equipment, and it's inexpensive ($100USD). The downside is that you have to stop the clock. The system also might be aware that it is in boundary scan mode.
Probe Station: This is a complicated method. You decap the IC and then can physically probe metal lines to get power information if the circuits are CMOS as it is voltage mode. The engineering time to know what you are looking for, and the cost of a probe station is prohibitive. Outside of engineering time, you'll need ($25kUSD) just for a probe station to get you 8-bits. It will go on up from there, but in the case of AES-NI, because it's a physical implementation, it's pretty obvious where the S-BOX hardware is. Also, on the one die that I saw with a SEM, it would be really easy to get to the data because the keys ran a long way on higher metal. Furthermore, the risk of damage to the IC is high because you are physically touching the wires.
Optically: This is the safest method to extract information where you look at the emissions from "switching" that are created when you have hot carries that put out an emission as they return to a lower energy level. This is an effect in classic physics that will always happen in a MOS device. You still need to decap the IC, and have a feel for what you are looking for specifically, but it does no physical damage. You also need a very good high speed imager, a gas chamber for your inert gas to keep the die from oxidizing, and a good engineer. This very complicated method will set you back about ($1M USD).
I have left out power attacks as I don't consider them to be very practical in most cases. I have decapped and FIB'd on power taps, but that's similar to the probe station method. Most large CPUs just have too much substrate noise for an external power attack at this point. You could also use quantum magnetometers spy on the traces on the ICs; however, this is basically theory. Igor Savukov has magnetometers with sensitivity that is high enough get B-field information out of traces, but that's also in the exotic range.
Basically, unless you are doing JTAG, it is generally out of the realm of probabilities for individuals.