Expose an API for validating a key file

[chrisccoulson]

There is an internal API for validating key files already. Ideally this would be improved to make it more useful and then exposed for diagnostic purposes in the event that the TPM sealed key could not be unsealed, and should provide a hint as to whether the TPM isn't provisioned correctly, a new TPM sealed key is required, or the metadata associated with the PCR policy is invalid.