Add stub of TPMv2 support

This does nothing useful yet, except detecting that we were given a
TSS2 private key blob and reporting that it's not supported. It does
help to ensure that when we come to implement this, we'll get the
user experience right. Which is "just give us the file".

We can do the actual implementation either via OpenSSL with one of
the TPM engines/providers, or by parsing the TSS2 ASN.1 ourselves
and driving the TPM directly. Not sure which is easier from Go.

aws_signing_helper/signer.go

@@ -190,6 +190,11 @@ func GetSigner(opts *CredentialsOpts) (signer Signer, signatureAlgorithm string,
 	if strings.HasPrefix(privateKeyId, "pkcs11:") {
 		return GetPKCS11Signer(opts.LibPkcs11, certificate, certificateChain, opts.PrivateKeyId, opts.CertificateId)
 	} else {
+		_, err := parseDERFromPEM(privateKeyId, "TSS2 PRIVATE KEY")
+		if err == nil {
+			return nil, "", errors.New("TPMv2 support not implemented yet")
+		}
+
 		privateKey, err := ReadPrivateKeyData(privateKeyId)
 		if err != nil {
 			return nil, "", err