security: in tpm::BackEndOsx, unwrap the key before importing it

We use our own openssl-based routines for the PKCS#8 decoding/decryption,
as they support a much wider range of algorithms than macOS's Keychain.

Change-Id: Ia841e7681a47563c696d054d46fe523f427c99cb
Refs: #4450
diff --git a/.travis.yml b/.travis.yml
index 1c238d3..6868f51 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -58,17 +58,16 @@
       osx_image: xcode9.4
       env: OSX_VERSION=10.13
     - os: osx
-      osx_image: xcode9.4
-      env: OSX_VERSION=10.13 USE_OPENSSL_1_1=yes
-    - os: osx
       osx_image: xcode10
       env: OSX_VERSION=10.13
+    - os: osx
+      osx_image: xcode10
+      env: OSX_VERSION=10.13 USE_OPENSSL_1_1=yes
 
   allow_failures:
     - env: COMPILER=clang++-3.6
     - env: COMPILER=clang++-3.7 DISABLE_ASAN=yes
     - env: COMPILER=clang++-8
-    - env: OSX_VERSION=10.13 USE_OPENSSL_1_1=yes
 
   fast_finish: true