The new checkpoint must either be a registry checkpoint or a cryptographic key checkpoint. Specify either -RegistryCheckpoint ...