hello rd1,
could you please try below,
I’m able to generate boot.img.encrypt as following,
for example,
$ sudo ./tegraflash.py --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --bl cboot.bin --cfg flash.xml --chip 0x21 --applet nvtboot_recovery.bin --cmd "sign"
this will assuming zero to filled SBK key,
it will copying signed file to $OUT/Linux_for_Tegra/bootloader/signed/
thanks