How can I prevent AES key being overwritten by hacker in MAX10

Hi, I'm referring Intel® MAX® 10 FPGA Configuration User Guide. In my understanding, once we program AES key and turn on "Allow encrypted POF only" option, configuring CRAM through JTAG will be p...