[tpm2] Recommended way to encrypt a credential

Let's assume I have a credential for some other remote system that I'd like to store somewhat protected so it can be used in a cron job. What is the recommended way? I see a few possibilities:

1. Create a primary key, an encryption key and seal the credential (it's small, less than 128 bytes)
2. Use an encryption key to encrypt something like a GPG passphrase (or maybe the GPG private key without a passphrase) and then gpg-encrypt a file that holds my credential
3. Use tpm2_encryptdecrypt which looks like some form of simplifying #2 above and may also work with files that may slightly exceed 128 bytes
4. Just store the credential directly at an NV index

Thanks!