This is the Cube Build Analyser

but the resulting binary file is 463k (473092 bytes).
The ELF is 5.2MB

My post build batch file is
arm-none-eabi-objcopy -S --strip-all -R .bss -R .main_heap -R .ccmram -O binary xxx.elf bin.dat
Probably I am not quite "stripping all" but what can I do to narrow it down?
The bin.dat is the file which is actually programmed into the CPU FLASH. I know this because I wrote all that code; the boot loader and all. That file is loaded from a FAT12 file system (FatFS) and its actual size in bytes is programmed. So if there is some excess in bin.dat, it doesn't do anything, or there is no excess and the Build Analyser display is BS.
The only reason this actually matters is because I have a code size ceiling of 510k in this version of the project, due to unrelated factors (the CPU is 1MB FLASH).
Of the total code size, about 300k is MBEDTLS

The "MBED" is a bit of a joke... Next year they will be calling a PC with 24GB RAM "embedded".