Thank you for your response.
We wanted to avoid storing keys ourselves if possible, as it's one more thing to worry about. With your answers we will consider our options.

Is there a possible workflow to combine Secure Boot with Flash encryption while in Release Mode and be able to reuse same chip for multiple releases (for example we botched OTA update and have to recover the chip on site)? From my current understanding, even if you use reflashable bootloader, if you...