Hi rt52,
I tried to do some research on this issue. I found a record that previously there was an issue with MAX 10 having a failure on performing RSU with encrypted POF. The engineering was able to come up with a workaround by using JTAG to program encrypted .jic to QSPI instead. You may refer to the guideline under 1.7.2. Programming the QSPI sub-topic in the AN 741: Remote System Upgrade for MAX 10 FPGA Devices over UART with the Nios II Processor user guide. I'm afraid this is the only possible workaround provided by the engineering team since MAX 10 is quite an old device. Hope it works.
Regards,
Fakhrul