Could it be that #clevis has a bug that the following ends up failing unless the passphrase is non-empty?
sudo clevis luks bind -d /dev/nvme... tpm2 '{"pcr_ids":"1,4,5,7,9"}'
An empty passphrase can be created by the means of:
sudo cryptsetup luksChangeKey --force-password /dev/sda3
It is a totally legit configuration for NUC7CJYH, which I use for kernel testing.