hello jim.pedavoli,
>> Q1
maybe part of op-tee binary did not update accordingly, I don’t know. we may dig into this.
at the moment, please recreating that EKS image with all 0s as your solution.
>> Q2
the OemKeyValid bit, for instance, Bit-9 of FUSE_BOOT_SECURITY_INFO_0 it controls whether the boot images need to be encrypted/signed or not.
for example,
if OemKeyValid is not burned. it should booting with non-encrypted and non-signed boot images.
in your use-case, once PKC+SBK are burned, it’s a must to provide signed and encrypted boot images for image flashing, (or, burning additional fuses).