hello jluysf,
FYI,
PKC for sign: if PKC is burned, then the KEYFILE users provide is for signing the images.
SBK for encryption: if SBK is burned, then the SBKFILE users provide is for encrypting the images.
KEKs for encryption keys: they are keys to encrypt your keys. KEK0, KEK1, KEK2 are 128-bit key files; KEK256 is 256-bit key file. please use the commands, --KEK* to determine which key encryption key you’re going to fused.
for Orin series, it supports PKC with RSA-3K only, and 256-bit SBK only;
XML based is validated only for AGX Orin platform. odmfuse uses openssl + tegraopenssl.
you may see-also Topic 266387 for more details of fuse configuration.