For secret and private keys, in object_create(), we first call object_create_skel() which checks, validates and adds default attributes.
In the priv|secret_key_set_default_attributes() we add and set LOCAL, SENSITIVE, ALWAYS_SENSITIVE, EXTRACTABLE, NEVER_EXTRACTABLE
attributes to defaults.
However, later in object_create, after object_create_skel, for private and secret keys, we check for SENSITIVE and EXTRACTABLE and then
get their values. We then call build_attribute() to create ALWAYS_SENSITIVE and NEVER_EXTRACTABLE attributes and set their values to their couterpart's values.
build_attribute appears to create another attribute into template rather than change the value for an existing attribute.
Thus, it appears we are adding the NEVER_EXTRACTABLE and ALWAYS_SENSITIVE attributes twice to the template and each occurence could have a different value.
Investigate and see if this is true.