I am using Quartus 21.1 but I can try the latest version.
Yes, I have been using 3.8.3.2 o on the document you linked to do all the programming so far. I tried 3.8.3.1 but my device would not boot.
I select the encrypted .pof image, right click and add the .ekp file generated in the same step, and also select an .ips file. I am not sure if the .ips file affects this but the .pof programming will fail without using an .ips file. This is done with an EtherBlaster. I can try a USB blaster but that should not make a difference.
If I am reading that table right, both images are encrypted with key x, and key x is loaded while programming. Config_sel pin is set to 1 so the device should boot into image 1, which it does without encryption