[tpm2] Re: Design for Secrets Encryption

Thanks for the great info!  In summary I think this approach will work for me:

Provisioning
- Generate a key using tss2_createkey
- Instruct TPM to unseal encrypted key using tpm_unseal
- Encrypt secrets using unsealed key and openssl

Runtime
- At boot, instruct TPM to unseal encrypted key using tpm_unseal
- Decrypt secrets using unseal key and openssl

I'm still working on the correct PCR register config for auth, but I'll couple this with a time based policy to mitigate the attack you described.

Thanks again!
Dan