Allow encrypted POF only

I am able to encrypt the file so I have the right license.  I know this because without "Allow Encrypted POF only", I loaded an encrypted .pof with its .ekp and the FPGA behaved as expected (aka... lights blink after programming).

Here is what I did and on the m50 development board from Altera.

1. Create an .ekp + .pof from the Convert Programming File with the allow encrypted POF only enable AND generate encrypted bitstream enable.  (I created multiple versions with different keys and different .sof to test out.)
2.  (Note:  I did this with loading the .ekp + .pof together and separate).  Program the FPGA with these files wait for successful programming.  --This works.
3. (power cycle the board- which didn't seem necessary but I did it anyways.)
4. Load a new/orig/same_key_generated_pof/different_key_same_sof/pof_only/sof_only/etc...  All the the results failed with  CONFIG_DONE pin failed to go high in device 1.  .... Operation Failed

At Step 4, either the original programming file used in step 2 should work or one of the different other configuration combination should have also worked.  But all fail. 

To get back to a working state, I had to erase the device.  I also figured out that I can load a .ekp file that does not have "Allow Encrypted POF only" to get back to a good working state. 

So back to the original question which is what does "Allow Encrypted POF only" do and what steps do I do during FPGA configuration to see that this is working as intended?  The definition of this feature is "When enabled, device only accepts encrypted POF".  But it does NOT appear that it accepts anything configuration including the original configuration used during the first initial programming.

Is there any other special thing I need to do?  Can you please check on your end to see?

Thank you!