i'm using a 32gbyte sandisk extreme plus, it's the 85mbyte/sec series, and it
works pretty well: i'm getting sustained 20mbytes/sec out of it.
encryption doesn't have anything to do with the storage media (one way or the
other), it's all "just data"
installing u-boot onto NAND: that's how i do it, using allwinner's (GPL'd)
bootloader and the sunxi-3.4 kernel. it's a little strange, but it's...
functional. long story: the NAND driver in the allwinner sunxi kernel was
developed entirely themselves, but not as an MTD driver. so a lot of work
has gone into re-creating the NAND driver in the sunxi community, which is
*still* ongoing. consequently, for "stable" use you have to use this rather
oddly-designed driver and a 3.4.104 kernel.
best overall to use micro-sd cards and help out with development of NAND
drivers.