[Tpm2] How to wrap/unwrap with TPM2 endorsement key?

Hi

I have a remote client A which wants to communicate securely with a server
B having a discrete TPM. My understanding is that each TPM normally comes
with an endorsement key from a manufacturer like Infineon. Therefore,
client A can validate client B's unique identity indirectly through a TPM
endorsement certificate by checking it against the manufacturer's CA
certificate. This can be easily achieved by retrieving ek certificate from
TPM NV index (below) or tpm2_getekcertifcate command, then sending it to
client A.

tpm2_nvread 0x1C00002 > rsa_cert

Since the endorsement key is a storage root key, it should not be used as
an encryption key according to information I found online. However, it
can(I think) be used to wrap/unwrap a symmetric encryption key to be used
in the subsequent operation. This means the client can extract the public
from the EK certificate and wrap an encryption key with it and send it back
to server B, but the problem is I could not figure out how to unwrap a file
with the private part of the endorsement key using tpm2-tools. Could
someone give me some guidance on this?

Thanks

Yu-Chieh