Do I need to use another approach? Encrypting the key with the DKEK, and then use something like sc-hsm-tool --unwrap-key?
@r2h2 Regarding further questions - could you make a separate post/topic please, for organizational purposes? We would set this one solved then.
sure 