[tpm2] Re: How we authorize the EK hierarchy to create AIK?