AM625: How to sign fitImage for HS-SE on SDK9.0?

Hi Team, 

I can use SDK9.0 sign tiboot3.bin, tispl.bin and u-boot.img by using top level makefile. But how to use top level makefile to sign fitImage, here is some error I encountered.

$make linux
...
# Build FitImage
cp /home/zane/AM62/ti-processor-sdk-linux-am62xx-evm-09.00.00.03/board-support/prebuilt-images/am62xx-evm/fitImage-its-am62xx-evm /home/zane/AM62/ti-processor-sdk-linux-am62xx-evm-09.00.00.03/board-support/ti-linux-kernel
mkimage -r -f /home/zane/AM62/ti-processor-sdk-linux-am62xx-evm-09.00.00.03/board-support/ti-linux-kernel/fitImage-its-am62xx-evm -k /home/zane/AM62/ti-processor-sdk-linux-am62xx-evm-09.00.00.03/board-support/ti-u-boot/board/ti/keys -K /home/zane/AM62/ti-processor-sdk-linux-am62xx-evm-09.00.00.03/board-support/u-boot-build/a53/arch/arm/dts/k3-am625-sk.dtb /home/zane/AM62/ti-processor-sdk-linux-am62xx-evm-09.00.00.03/board-support/built-images/fitImage
Can't set hash 'value' property for 'hash-1' node(FDT_ERR_NOSPACE)
Can't set hash value for 'hash-1' hash node in 'fdt-ti_k3-am625-sk-csi2-tevi-ov5640.dtbo' image node
Failure reading private key: error:1E08010C:DECODER routines::unsupported
Failed to sign 'signature-1' signature node in 'conf-ti_k3-am625-sk.dtb' conf node
mkimage Can't add hashes to FIT blob: -1
make: *** [makerules/Makefile_linux:13: linux] Error 255

I generated the Key using the following command.

./gen_keywr_cert.sh -g

And use the following command download key to efuse.

Step 1:

cd ~/ti/mcu_plus_sdk_am62x_09_00_00_19/source/security/sbl_keywriter/scripts/cert_gen/am62x

./gen_keywr_cert.sh -t tifek/ti_fek_public.pem -b keys/bmpk.pem -s keys/smpk.pem

cd ~/ti/mcu_plus_sdk_am62x_09_00_00_19/source/security/sbl_keywriter/scripts/x509cert

python3 ../../../../../tools/bin2c/bin2c.py final_certificate.bin keycert.h KEYCERT

cd ~/ti/mcu_plus_sdk_am62x_09_00_00_19/source/security/sbl_keywriter/am62x-sk/r5fss0-0_nortos/ti-arm-clang

make -sj PROFILE=debug

Step 2 & 3: Repeat the process of step 1 using the command below

./gen_keywr_cert.sh -t tifek/ti_fek_public.pem --smek keys/smek.key

./gen_keywr_cert.sh -t tifek/ti_fek_public.pem --bmek keys/bmek.key --keycnt 2 --keyrev 1

Before build u-boot, I copy smpk.pem to ti-u-boot/board/ti/keys, and renamed it to custMpk.pem