I went through exactly the same process as you:

1) original code in Arduino ... ran into lack of encryption support
2) ported code to ESPIDF using arduino as a component
3) MD5 checksum error when trying to load Arduino firmware via OTA (on an encrypted device)
4) compiled the OTA firmware using ...

Hey - did you guys figure out a way to do this?

Specifically, looking for step-by-step instructions for taking a XXX.bin from an Arduino-compiled ESP32 project,
and using only the command line tools (esptool.py, espefuse.py, espsecure.py) to
1) set up secure boot (V2?)
- creating keys
- sign ...