I'm successfully flashing encrypted OTA firmware using this procedure:

Patch the $(IDF_PATH) with the attached diff
This will disable the https OTA and use normal http instead
Also it prevents the double encryption when flashing OTA since the firmware binary is already encrpted
Generate a ...