Is it a chicken - egg problem? With ask-pin option the pin is not valid because the TPM was wiped and without the option, the system insists to provide the recovery pin... What command is used to enroll the TPM during the installation or during firstboot respectively?