About S10-AS Encryption Flow

Hi, friends:

I've a question about the Program process of Encrytion flow on 1SG280HH2F55E2VGAS
Some work mate told me: first we should program root key (.qky) file to real eFuse(or virtual eFuse) with JTAG , then Program the Encryption key(.qek) to BBRAM with JTAG.
I'm doubt about this view because in "ug-s10-security" ,Figure 13. Design Flow for Owner Image Encryption in Intel Stratix 10 Devices,
About the Stage #3 Program step . I did not find root public key(.qky) need to be programed. It seems programing .qek is enough to go on.
Is my conclusion true? thanks!

Jeff