I found the following comment in this post: https://community.nxp.com/docs/DOC-330885
It is quite easy to generate an encrypted SB image. No need to modify the command file. Just add "-k KeyFile" to the command line, and remove "-z". <KeyFile> is a text file containing the AES key. You can generate one with "-K" parameter.
BTW, to let bootloader parse the encrypted sb file, you also need to program the AES key into device's IFR field, and the device must support hardware decryption.
You can refer to the "Kinetis ROM bootloader" chapter in the device's reference manual about the hardware decryption support and IFR programming.
The MKV31 is a supported processor in the Bootloader Document but it is not obvious whether the MKV31 can actually handle an encrypted SB image. I do not believe it has any crypto hardware to handle this decryption task. Can it be done in software?