Hello,
Could you help us clarify if you're asking about KW45B41Z-EVK instead of the KW85?.
NXP provides the KW45B41Z-EVK board burnt with default fuses, only the KW45 chip from factory have the fuses null.
NXP fuse the KW45 that comes with the KW45B41Z-EVK board with authentication keys [SBKDK and RoTKTH] [Chapter 5.2.1 AN14003] and certificate generation, then Burn KW45 ROM bootloader fuses with the keys to generate a secure binary file [sb3] and update the radio core firmware [Also called as Narrow Band Unit (NBU) that features a Bluetooth Low Energy (LE) unit with a dedicated flash] via ISP using the SPSDK tool.
For more information about this please refer to:
Getting Started with the KW45B41Z Evaluation Kit | NXP Semiconductors and AN13883 Updating KW45 Radio Firmware Via ISP Using SPSDK
The role of the fuses is for accessing correctly in the ROM bootloader and only authenticated NBU firmware can run on the radio core such as Wireless examples from the SDK, otherwise the ROM bootloader will not boot and because NBU will always require that the authentication is successful to boot appropriately is priority that the KW45 has a fuse configuration.
The recommended operation for the KW45 chip from fabric is fuse the chip according to the AN14003. The decision for entering the fuses will be if the chip needs to be operating same as the KW45B41Z-EVK board [Burning default keys, Chapter 5.2.1 AN14003] or operating to a custom modification [Creating his own keys]. As the boot ROM needs to communicate to NBU flash so the wireless examples can operate.
The ROM bootloader is located in the CM33 core for KW45, its purpose is to access to the NBU flash for flashing the NBU firmware for using wireless examples.
For more information about this, please refer to KW45 Reference Manual Chapter 15 and the Process flow used in AN14003 Figure 2
Best Regards
Luis