Working on encryption with max 10 device. Having problems programming .ekp & .pof separately

Ok, I was able to finally program an encrypted FPGA with initialized UFM by moving our lookup table (that was in the UFM) to an area above the key and ICB area (0x000 to 0x7FF). We moved our lookup table to 0x1000. However, Our customer wants to program the CFM with the encrypted FPGA program during mfg, then calibrate the device and program the UFM at a later time (without changing the main FPGA program in CFM). Before using encryption, we have been doing this by converting the intel hex file and then programming the UFM only later with the programmer. I don't seem to be be able to do this now that my CFM is encrypted?