[Tpm2] tpm2_policyauthorize applied directly on tpm-based key instead of file

Hi TPM-users and experts!

I tried to use the code from Nicolas Oliver to create a tpm-based key which has a “Wildcard Policy” i.e. an Authorized Policiy to allow using the key only with specified PCR values; and still being able to change those PCR values later on using a signature.  Support for this is provided thorough the tpm2_policyauthorizecommand.
I just adapted the code from https://github.com/latchset/clevis/issues/121

Instead of sealing a file (in the code Nicolas it is file secret.txt I tried to use a tpm-stored key within the “normal” owner hierarchy created with tpm2_create i.e. a subkey of the primary key.  When I try to unseal the key with the correct policy at the end of the code I get the following error:
/home/user# tpm2_unseal \
    --object-context 0x81000005 \
    --auth session:session1.ctx
WARNING:esys:src/tss2-esys/api/Esys_Unseal.c:295:Esys_Unseal_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_Unseal.c:98:Esys_Unseal() Esys Finish ErrorCode (0x0000018a)

ERROR: Esys_Unseal(0x18A) - tpm:handle(1):the type of the value is not appropriate for the use

Can’t we use tpm2_policyauthorize directly on tpm-keys in tpm2-tools? (or maybe it is written in the spec where I haven’t read all the details.)
Here is part of my code; the complete code can be seen in  https://github.com/latchset/clevis/issues/121 :

 # Create a PCR policy |

tpm2_startauthsession --session session.ctx

tpm2_policypcr \

    --session session.ctx \

    --pcr-list sha256:0,1 \

    --policy pcr.policy

tpm2_flushcontext session.ctx

rm -f session.ctx



# Generate public/private key pair for signing


Rest of the code see github/ latchset (link above)…

I removed the following option from tpm2_create (compared to github:

 --sealing-input secret.txt \






tpm2_create \

    --parent-context primary.ctx \

    --hash-algorithm sha256 \

    --public key.obj.pub \

    --private key.obj.priv \

    --policy authorized.policy



tpm2_load \

    --parent-context primary.ctx \

    --public key.obj.pub \

    --private key.obj.priv \

    --name key.obj.name \

    --key-context key.obj.ctx



# Persist the TPM Object

tpm2_evictcontrol \

    --hierarchy o \

    --object-context key.obj.ctx \

    0x81000005



 # Sign the PCR policy



…



# Unseal the TPM object using the Authorized PCR Policy

…





tpm2_unseal \

    --object-context 0x81000005 \

    --auth session:session1.ctx

If you have any idea why this does not work or – even better - a solution to my problem I would be very happy hearing it.
Armin