Quartus Prime Programmer: How to integrate ekp into pof for programming Max10 FPGA

UG-M10CONFIG 2021.07.02 Intel® MAX® 10 FPGA Configuration User Guide page 53 states:

3.8.3.2. Integrate the .ekp into .pof Programming
To integrate the .ekp into .pof and program both altogether using the Intel Quartus
Prime software, follow these steps:
1. In the Intel Quartus Prime Programmer, under the Mode list, select JTAG as the
programming mode.
2. Click Hardware Setup and the Hardware Setup dialog box will appear.
3. Select USBBlaster as the programming hardware in the Currently selected
hardware list and click Done.
4. Click the Auto Detect button on the left pane.
5. Select the .pof you want to program to the device.
6. Select the <yourpoffile.pof>, right click and select Add EKP File to
integrate .ekp file with the .pof file.
Once the .ekp is integrated into the .pof, you can to save the integrated .pof
into a new .pof. This newly saved file will have original .pof integrated
with .ekp information.
7. Select the <yourpoffile.pof> in the Program/Configure column.
8. After all settings are set, click Start to start programming

Using Quartus Prime 16.1 I follow this and I note that the Checksum does change when the ekp is added and for that attempt at programming (where a EKP file is listed in the EKP column) it works.

However if this new .pof is used later (it does have the correct latest checksum matching that used when this worked) but now when nothing is listed in the EKP column the FPGA does not configure with this. i.e. programming is successful but the board does not seem to have the ekp information to decrypt the pof information.

It is like this new pof has the ekp integrated in it but perhaps this part is not getting programmed into the Max10. I notice that the original pof file and the integrated one are both the exact same file size.

I expect to be able to program a Max10 with just this integrated encrypted pof file without having to program it separately with a ekp.

What is it that I am not doing?

Thanks

PS. I notice that when I start with the Terasic DE10-Lite board from factory setting, I can program the board with an integrated encrypted pof file once then if I try with a different integrated encrypted pof file (i.e. one that used a different key) this fails to config the FPGA