Works for me, unwrapping an AES key onto the token.
Worked with latest propopsed tks code, using one of the new JSS features.
Down voting only to be able to fix a rhel compat compilation issue, that still works in Fedora, but we don't want to depend on that.
Works.