Encrypt digests being signed with IBM TSS2.
Encrypt digests being signed with IBM TSS2.

The digest itself will end up on the wire. But the computed hash including
the secrets should probably be obsecured. For the TPM that's an input
parameter, which it must decrypt. Hence TPMA_SESSION_DECRYPT.

Signed-off-by: David Woodhouse <97b3379caa91f4ee97e44013ae4dc6350540fa9d@infradead.org>

brandt/openconnect,brandt/openconnect,brandt/openconnect,brandt/openconnect