Is your feature request related to a problem? Please describe.
Yes, the problem being unable to enroll keys in a tpm2 device with the owner hierarchy password protected. See here for reference.
When running systemd-cryptenroll on a tpm2 device with the owner hierarchy protected by a password the following message is reported:

WARNING:esys:src/tss2-esys/api/Esys_CreatePrimary.c:400:Esys_CreatePrimary_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:135:Esys_CreatePrimary() Esys Finish ErrorCode (0x000009a2) 
WARNING:esys:src/tss2-esys/api/Esys_CreatePrimary.c:400:Esys_CreatePrimary_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:135:Esys_CreatePrimary() Esys Finish ErrorCode (0x000009a2) 
Failed to generate RSA primary key in TPM: tpm:session(1):authorization failure without DA implications

Describe the solution you'd like
A mechanism to specify the authorization hierarchy password when running systemd-cryptenroll, or systemd-cryptenroll should
take ownership of the tpm device itself.

Describe alternatives you've considered

• Up until now i have used a custom approach based on initrd hooks and scripts which work well, i was just trying to switch to systemd-cryptenroll and found out i can only use it with a passwordless tpm device.

• Removing the password from the owner hierarchy and systemd-cryptenroll works as expected.

The systemd version you checked that didn't have the feature you are asking for
systemd 250 (250.2-2-arch)