PROCESSOR-SDK-AM62X: AM62x – Secure Boot: Signed-only → Signed+Encrypted Migration

Tool/software:

Hi,

For AM62x secure boot setup:

• I will burn smpk (Secure Master Public Key) into OTP.
• I also plan to burn an AES-256 key into OTP at the same time.

Questions:

1. Can I start by deploying signed-only images (no encryption flag in certificate)?
2. Later, can I switch to signed+encrypted images without any further OTP programming?
3. Is my understanding correct that:
   • smpk only fused → signed boot only (HS-FS).
   • smpk + AES key fused → BootROM can accept both signed-only or signed+encrypted images depending on cert?
4. Does SDK support generating encrypted images?

Just want confirmation that provisioning the AES key upfront allows migration from signed-only to signed+encrypted by updating images/certs only.

Thanks.