This doesn't sound like something you'd do with regular TPM key objects.
However, TPMs do have a small amount of general-purpose NVRAM, which you can access by allocating an "NV index" (e.g. using
tpm2 nvdefine) and storing any data you want (such as a public key or a whole certificate). For example, usually you'll find a predefined index 0x1c00002 containing the TPM's "endorsement certificate" from the manufacturer.
NV indices can have various read/write conditions – specifying
ownerwrite will require the "owner hierarchy" password in order to change its contents, and enabling
writedefine allows the NV index to be locked and made unwritable. Normally owner auth is already required in order to delete (aka undefine) the NV index, but
policydelete with a blank policy should make it completely undeletable.
Note: I don't have any spare TPMs so I've never actually tried making permanent NV indices or otherwise bricking a TPM. However, if I understand the spec correctly, clearing the TPM will still delete all "owner"-created NV indices, even those that you somehow (accidentally) made impossible to delete.