How to load external key into tpm example

We noticed that tpm2-tools provides a convenient way to load external keys into the TPM using the tpm2_loadexternal command .

When trying to achieve the same with the tss-esapi crate, it seems that one first needs to load the key into the NULL hierarchy and then duplicate it into another hierarchy. If we understand this correctly, this two-step process is necessary to load a key into a non-NULL hierarchy.

It would be really helpful if the repository included an example demonstrating this workflow. We started implementing the first step (loading the key into the NULL hierarchy) but encountered the following error:
WARNING:esys:src/tss2-esys/api/Esys_LoadExternal.c:314:Esys_LoadExternal_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/api/Esys_LoadExternal.c:108:Esys_LoadExternal() Esys Finish ErrorCode (0x000001ca)
Error: Tss2Error(FormatOne(FormatOneResponseCode { .0: 458, error_number: 10, parameter: true, format_selector: true, number: 1 }))

Decoding 0x000001ca using tpm2_rc_decode gives:

tpm:parameter(1): the type of the value is not appropriate for the use.

For repoducing a minimal Rust example can be found in this gist.

For comparison, the equivalent step using the tpm2-tools CLI would be something like:
tpm2_import
-C "primary.ctx"
-G hmac
-i "key.txt"
-u "imported_key.pub"
-r "imported_key.priv"
-a "sign|sensitivedataorigin|userwithauth"

If there’s interest from the maintainers, we’d be happy to contribute an example or add a small convenience function for this - but we’re currently stuck at the loading step mentioned above.

Start with the linked minimal Rust example and the tpm2_loadexternal documentation, then compare the reported Esys_LoadExternal error with the tpm2-tools workflow. A suitable contribution would demonstrate loading an external key and the subsequent duplication workflow, or provide a convenience function, with the loading step working for the reported case.