DE10-nano Encrypted ROM IP Content help

You can embed an AES key in the FPGA's configuration (the .rbf file). It can be as easy as hardcoding it as a constant in an hardware AES core.

Although possible in theory, it would be very difficult for someone to try and recover your AES key from the .rbf file. But if you want to avoid this, you can also use an encrypted .rbf file with another AES key. That key is stored in a special non volatile memory in the FPGA but can't be accessed from the application, so you'd need two keys. One for the FPGA configuration itself, and one to decode your encrypted file.