hello nekochang,
may I have more details, for instance, which Jetpack public release version you’re working with?
>>Q1
Image-based OTA support updating with Rootfs-A/B.
>>Q2
you’ll need to fuse a target to enable secure boot.
please see-also Topic 300161 for the steps we’ve verified.
>>Q3
you may see-also Overlayfs on Root File System.
>> Q4
it’s ROOTFS_ENC=1 to enable disk encryption.
there’s key file within EKS image, you’ll need to re-create eks_t234.img with public release sources.
please see-also Topic 264454 for reference.