Due to an issue with the Quartus® Prime software versions 16.0 and earlier, the .cof file saved for generating encrypted files does not contain information that specifies the usage of a volatile or non-volatile key. It defaults to a volatile key which may cause configuration from the .jic file to fail if you have programmed a non-volatile key into the Arria® 10 device.
To workaround this, either manually disable the "Enable volatile key security" option in the Convert Programming Files GUI after you have loaded the .cof file before you generate the encrypted .jic file, or if you are using quartus_cpf, add the option non_volatile_key=on as shown below to generate the encypted .jic.
quartus_cpf -c --key <keyfile>:<keyid1> -o non_volatile_key=on -d <config_device_name> -s <serial_flash_loader_device_name> <input_sof_file> <output_jic_file>
This issue will be fixed in a future release of the Quartus Prime software.