Assuming that your TLS stack can support SHA-256 and ECDSA, you can choose any of the ESP device and it should be okay. Which TLS stack are you using?
We strongly recommend using code signing to ensure that devices only run code published by trusted authors and that the code hasn’t been changed or corrupted since it was signed. Here is the more detailed documentation: What is AWS Signer? - AWS Signer. If you still want to send unsigned images (again, NOT RECOMMENDED) , you probably can use “Use my custom signed file” option.