Thanks to security PM Russ Lowenthal for this info

Early versions of TDE supported extracting the key from a certificate. This was only supported for column encryption and was rarely used. It is unlikely that you are using PKI keys, but if you are concerned, here is how you can check:
- PKI keys were only used with column-level encryption and are not compatible with tablespace encryption. If you are using tablespace encryption, then you can not be using PKI TDE keys. To check, query V$ENCRYPTED_TABLESPACES. If any rows are returned, then you can not be using PKI TDE keys because tablespace encryption doesn't work with PKI keys, and you can stop here. If no rows were returned, proceed to step two
- Query DBA_ENCRYPTED_COLUMNS. Are any rows returned? In almost all cases the answer will be no since we haven't recommended column encryption since Oracle 11.1. If there zero rows are returned are no encrypted columns, then you are almost certainly not using PKI TDE keys, but you should still run step three to make certain no one ever initialized the master key using PKI.

To verify that your database’s master encryption key was not initialized using PKI, run this query:

select cert_id from v$wallet where status='IN USE';

If there are zero rows returned, you are NOT using PKI encryption keys and you may proceed with the upgrade to 23c. If you have one or more rows returned, then you should rekey your database using:

administer key management set key identified by <keystore password> with backup;

After which you are clear to proceed with your upgrade.