Upgrade TPM key storage from downlevel versions.

mount.cc

Index: mount.cc
diff --git a/mount.cc b/mount.cc
index d8a1c3b49850e3fc2b60b1c748f4705dc7ffefa3..8b38884a9c884bf2fa638ebac8be1fe7962931b7 100644
--- a/mount.cc
+++ b/mount.cc
@@ -399,12 +399,16 @@ bool Mount::UnwrapVaultKeyset(const Credentials& credentials,
       bool should_tpm = (crypto_->has_tpm() && use_tpm_);
       bool should_scrypt = fallback_to_scrypt_;
       do {
-        if (tpm_wrapped && should_tpm)
-          break; // 5, 8
-        if (scrypt_wrapped && should_scrypt && !should_tpm)
-          break; // 12
-        if (!tpm_wrapped && !scrypt_wrapped && !should_tpm && !should_scrypt)
-          break; // 1
+        // If the keyset was TPM-wrapped, but there was no public key hash,
+        // always re-save.  Otherwise, check the table.
+        if (crypto_error != Crypto::CE_NO_PUBLIC_KEY_HASH) {
+          if (tpm_wrapped && should_tpm)
+            break; // 5, 8
+          if (scrypt_wrapped && should_scrypt && !should_tpm)
+            break; // 12
+          if (!tpm_wrapped && !scrypt_wrapped && !should_tpm && !should_scrypt)
+            break; // 1
+        }
         // TODO(fes): This is not (right now) a fatal error
         ResaveVaultKeyset(credentials, *vault_keyset);
       } while(false);