Binary size with enabled flash encryption

[GeorgesLab]

Hello,
I'm just curious why is flash binary size changed when I enable secure boot and flash encryption on boot in security features?
I thought that all code overhead for encryption and secure boot will be in bootloader code, and not in application?

Normal binary size is 1 013 120B and with secure options is size 1 048 564B .

Thank you for clarification.

[brp80000]

You use "Sign binaries during build" in secure boot?
You use "Enable flash encryption on boot"?
You use "Generate an MD5 checksum for the partition table"?