It should be possible to use bitstream encryption on the Red Pitaya with the key in BBRAM. But you will need to reprogram the key every time the board loses power.
The \$V_{CC\_BATT}\$ pin of the Zynq-7000 chip seems to be unconnected according to the Red Pitaya schematic. For this package (CLG400), it would be pin F11, which is not mentioned in the schematic. So one might think that the BBRAM could not be used, because no battery can be connected to the Zynq on this board (without extreme measures like PCB drilling).
But in XAPP1239, on page 3 it says:
When an encryption key is stored in the FPGA's battery-backed RAM, the encryption key
memory cells are volatile and must receive continuous power to retain their contents. During
normal operation, these memory cells are powered by the auxiliary voltage input (VCCAUX). A
separate VCCBATT power input is recommended for retaining the key when VCCAUX is removed.
Therefore it is recommended that the AES key be programmed in-system on a board that has
the battery back-up. Otherwise, the key is lost when power/battery is removed.
So the BBRAM should work even without \$V_{CC\_BATT}\$ connected. There is probably a diode OR inside the chip to supply the BBRAM from \$V_{CC\_AUX}\$ if possible, to not drain the backup battery while the regular supply is available.
The downside is, you'll have to reprogram the key into the BBRAM every time you power up the Red Pitaya, if you don't have it connected to a power supply permanently.
