The Cypress-provided PSoC build uses the cymcuelftool to package the image in a suitable format (TOC2 and Cypress Standard Application Format) for the romboot code to validate and then execute.
For a secure system, this normally includes the non-secure (CM4) image, but we probably want to deviate as little as possible from the existing TF-M mechanisms.