Before you include the lock, I would suggest to exclude it. This should ensure that the device is totally reset - secure inclusion has to happen within 15 seconds of the initial inclusion, and if it doesn’t (eg if it was already included) it will never work.
I would also suggest to double check that you are really running the right version - ie using the Karaf console. Sometimes OH can cache bindings and you may still be running an old version.
If all else fails, it would be worth looking at the debug logfile to see what is happening.