How to write an EPCQ without using the FPGA as a bridge

[Altera_Forum]

I plan to use the design security feature of Cyclone V. According to AN-556, after the key withtamper-protection bit set is programmed into the FPGA, external JTAG port can only accept mandetory commands. I think this means that I am not able to program the FPGA using JTAG any more. This is fine for security.  

 But what if I want to change or update my software (configuration data) now? The Serial FlashLoader supported by Quartus II will not work any more now since the JTAG port is blocked. However, there must be a method to re-write the EPCQ chip where the configuration data are stored. Does anyone know how to write EPCQ in this situation?  Thanks a lot for any information!

[Altera_Forum]

You might be able to make an encrypted version of the configuration that programs the EPCQ. It would need to use the same key that is programmed into the FPGA. I've never used the encryption feature, so I don't know any details.

[Altera_Forum]

--- Quote Start ---  You might be able to make an encrypted version of the configuration that programs the EPCQ. It would need to use the same key that is programmed into the FPGA. I've never used the encryption feature, so I don't know any details.  --- Quote End ---    thank you for the tip.   Based on your idea, I think I could do like this: I make a second board with the FPGA not tamper-protected. This can be called as a "programmer". Using it I can write a new EPCQ with encrypted configuration data. Then I replace the old EPCQ on the target board with the new one. To make the work easier, the programmer could use a chip socket for EPCQ.   This approach is more complex than on-line programming, but it is any way a good solution.