hello user141301,
sorry, I got confirmation that Image-based OTA does not support the case of disk encryption enabled. I will also revise my previous comments to avoid confusion.
furthermore,
if you’ve enables PKC/SBK, you may use r32.7.3 to do image-based OTA because the image-based OTA tools before r32.7.3 has some issues on supporting PKC/SBK.