Working on encryption with max 10 device. Having problems programming .ekp & .pof separately

I was able to finally configure and program the device encrypted by moving my initialized UFM from 0x000 to 0x1000. Apparently I was overwriting the key and ICB stored at 0x000. My concern now is , our customer wants to program the CFM with the encrypted FPGA program during mfg, then calibrate the device and program the UFM at a later time (without changing the encrypted CFM).

Before encryption, we have been doing this by converting the intel hex file and then programming the UFM only with the programmer. I can't seem to do this without affecting the stored key and ICB at 0x000 to 0x7FF?

If you have any insight into this, I would appreciate some feedback.