Why constrain the certified key to only be none restricted

In the `CertificationParameters`, when we check the key parameters we check that it's none restricted.
I'm curious about the case that after activating the AK, we need to prove that some restricted key is also in the same TPM.

https://github.com/google/go-attestation/blob/master/attest/certification.go#L146

Start with attest/certification.go at line 146 and read how CertificationParameters validates key parameters. Investigate the TPM attestation flow described in the issue, including whether a restricted key can prove it is in the same TPM. Done should establish whether the restriction is intentional or define the required change for supporting restricted keys.

Written by the indexing model from the issue text.