tpm2-util: return better errors if we try to unlock a tpm key on the wrong tpm

Let's improve error handling in case one tries to unlock a TPM2 locked
volume on a different machine via TPM than it was originally enrolled
on. Let's recognize this case and print a clearer error message.

src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c

@@ -109,6 +109,8 @@ int acquire_luks2_key(
                         n_policy_hash,
                         srk,
                         ret_decrypted_key);
+        if (r == -EREMOTE)
+                return log_error_errno(r, "TPM key integrity check failed. Key enrolled in superblock most likely does not belong to this TPM.");
         if (r < 0)
                 return log_error_errno(r, "Failed to unseal secret using TPM2: %m");