Doing a little digging,
From https://patchwork.ozlabs.org/project/uboot/patch/20210822044649.13585-3-samuel@sholland.org/
"Most Allwinner sunxi SoCs have separate boot ROMs in non-secure and secure mode. The "non-secure" or "normal" boot ROM (NBROM) uses the existing sunxi_egon image type. The secure boot ROM (SBROM) uses a completely different image type, known as TOC0."
I am not an expert, but I feel that is likely the issue here. Since the X96 s400 will launch the bootrom, it should only require a bootrom change.
from https://linux-sunxi.org/TOC0#U-Boot.27s_mkimage
It should only need a RSA key generated, as the X96 S400 will launch the sboot, thus no Vendor e-fuse should be set.