Hi,
flash.sh is correct since pkc_disable=0x1 is NS. For enabling secureboot, you need to have -c PKC -p -k …/emi_pkc.pem so that pkc_disable keep 0x0. If you have -c PKC -k …/emi_pkc.pem(no -p), pkc_disable is burned to 0x1 and no longer returns to PKC mode forever.