trusted-keys: match tpm_get_ops on all return paths