Cannot sign with signtool: No private key is available.

I have followed the example using a self signed cert to test: "Signing Windows Artifacts" https://cloud.google.com/kms/docs/reference/cng-signtool
But i get the error `SignTool Error: No private key is available.`

```
gcloud kms keys create dan-test --keyring build-ring --project xm-cloudbuild --location us --purpose "asymmetric-signing" --default-algorithm "ec-sign-p256-sha256" --protection-level "hsm"
openssl req -new -x509 -days 3650 -subj '/CN=test/' -sha256 -engine pkcs11 -keyform engine -key pkcs11:object=dan-test > ca.cert

C:\certificate\dan\new>type c:\Windows\KMSCNG\config.yaml
---
resources:
- crypto_key_version: "projects/xm-cloudbuild/locations/us/keyRings/build-ring/cryptoKeys/bc-connector-sign-ec-2/cryptoKeyVersions/1"
- crypto_key_version: "projects/xm-cloudbuild/locations/us/keyRings/build-ring/cryptoKeys/dan-test/cryptoKeyVersions/1"

"SIGNTOOL.EXE" sign ^
More? /v /debug /fd sha256 /t http://timestamp.digicert.com ^
More? /f ca.cert ^
More? /csp "Google Cloud KMS Provider" ^
More? /kc projects/xm-cloudbuild/locations/us/keyRings/build-ring/cryptoKeys/dan-test/cryptoKeyVersions/1 ^
More? my.app

The following certificates were considered:
Issued to: test
Issued by: test
Expires: Thu Aug 04 02:49:06 2033
SHA1 hash: 3D7D816E2E68EA4671621CEB31C89340157C1EB8

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
The following certificate was selected:
Issued to: test
Issued by: test
Expires: Thu Aug 04 02:49:06 2033
SHA1 hash: 3D7D816E2E68EA4671621CEB31C89340157C1EB8

SignTool Error: No private key is available.
```

if i then import the certificate using windows `mmc` and run repair to associate the private key, i get the following error regarding `unsupported legacy key spec`

Is there anything else i can do to debug the issue?

```
certutil -user -repairstore My 3D7D816E2E68EA4671621CEB31C89340157C1EB8
My "Personal"
================ Certificate 4 ================
Serial Number: 514da11934da497ed7c7f7cb1cbec8bf79cdb233
Issuer: CN=test
NotBefore: 07/08/2023 02:49
NotAfter: 04/08/2033 02:49
Subject: CN=test
Signature matches Public Key
Root Certificate: Subject matches Issuer
Cert Hash(sha1): 3d7d816e2e68ea4671621ceb31c89340157c1eb8
Key Container = projects/xm-cloudbuild/locations/us/keyRings/build-ring/cryptoKeys/dan-test/cryptoKeyVersions/1
I0807 02:56:27.243154 4272 logging.cc:81] returning 0x80090027 from OpenKeyFn due to status INVALID_ARGUMENT: at bridge.cc:187: unsupported legacy key spec specified: 0 [type.googleapis.com/kmscng.StatusDetails='SECURITY_STATUS=0x80090027']
Provider = Google Cloud KMS Provider
I0807 02:56:27.244982 4272 logging.cc:81] returning 0x80090029 from SetProviderPropertyFn due to status NOT_FOUND: at provider.cc:108: unsupported property specified [type.googleapis.com/kmscng.StatusDetails='SECURITY_STATUS=0x80090029']
I0807 02:56:27.245626 4272 logging.cc:81] returning 0x80090027 from OpenKeyFn due to status INVALID_ARGUMENT: at bridge.cc:187: unsupported legacy key spec specified: 0 [type.googleapis.com/kmscng.StatusDetails='SECURITY_STATUS=0x80090027']
Encryption test FAILED
CertUtil: -repairstore command completed successfully.
```

Public key matches
```
C:\certificate\dan\new>gcloud kms keys versions get-public-key --keyring build-ring --key dan-test --location us --project xm-cloudbuild 1
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk6ALoGc+vV2Jod/BV98qxxqbIlWY
XJ3sdaYAEECvM9c/Xvi9cHnk72OQhRtJb6zJiQs8i/HgxmukNOHSzjTVCg==
-----END PUBLIC KEY-----

Updates are available for some Google Cloud CLI components. To install them,
please run:
$ gcloud components update

C:\certificate\dan\new>openssl x509 -in ca.cert -pubkey -noout
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk6ALoGc+vV2Jod/BV98qxxqbIlWY
XJ3sdaYAEECvM9c/Xvi9cHnk72OQhRtJb6zJiQs8i/HgxmukNOHSzjTVCg==
-----END PUBLIC KEY-----
```