raspi3: document that the encrypted example needs a provisioned key

Removing the hardcoded test key is right, but nothing on this target
calls wolfBoot_set_encrypt_key() any more, so the shipped example and
the docs walk-through (whose example key was that same test key) no
longer boot an encrypted image. Say so in both places.

config/examples/raspi3-encrypted.config

@@ -1,3 +1,7 @@
+# NOTE: the raspi3 HAL no longer ships a hardcoded test encryption key.
+# Nothing in this target calls wolfBoot_set_encrypt_key(), so an image
+# built with this config will reject encrypted updates until a key is
+# provisioned. See "Testing with kernel encryption" in docs/Targets.md.
 ARCH?=AARCH64
 TARGET?=raspi3
 SIGN?=RSA4096

docs/Targets.md

@@ -3758,6 +3758,20 @@ make wolfboot.bin CROSS_COMPILE=aarch64-linux-gnu-
 printf "0123456789abcdef0123456789abcdef0123456789ab" > /tmp/enc_key.der
 ```
 
+* Provision the same key into the bootloader
+
+  The raspi3 HAL does not ship a hardcoded key: `hal_init()` used to call
+  `wolfBoot_set_encrypt_key()` with a fixed test key compiled into the
+  image, which meant every build shared one publicly known secret. It was
+  removed, so the bootloader now has no key until one is provisioned and
+  encrypted updates fail closed.
+
+  To run this demo, call `wolfBoot_set_encrypt_key()` with the 32-byte key
+  and 12-byte nonce from the file above at the end of `hal_init()` in
+  `hal/raspi3.c`. That is a development-only shortcut: a real deployment
+  must provision a per-device key from a source that is not in the
+  firmware image (see [encrypted_partitions.md](encrypted_partitions.md)).
+
 * Sign and encrypt Linux kernel image
 ```
 make keytools