Don't use blk3, store it in an encrypted partition with secure boot and flash encryption enabled.

I suggest you put pressure on your sales rep to get a fix backported to 2.1. I told you 100 times you would regret using older sdk versions.

Coming out of deep sleep is basically like a cold boot with a few exceptions like rtc ram and wake stub. But if you want your app to resume you have to use light sleep.

It is possible to use HS1 for sd/mmc if you put the flash on other pins. The SD_ pin labels are for sdio slave mode in which case you wouldn't have a flash chip. It is definitely not ideal.

They are used for the flash chip. The app executes from the flash chip. Already told you that here viewtopic.php?f=12&t=7686&p=32347#p32394

No, you can still use hw acceleration without flash encryption just turn it on in menuconfig and use the mbedtls functions.

You are probably leaking memory. You should use MALLOC_CAP_DEFAULT.

Check free memory with heap_caps_get_free_size. Don't free the memory until it is received from the queue. Keep all your related questions in one topic. Learn the basics of memory management.

No, the reason it uses less power is because the radio and cpus are off.

Using brownout to detect a low but stable-enough-to-do-complicated-things battery voltage is not really the intended use.