After writing a non-volatile AES key to an Arria® 10 SoC device, I programmed it into the configuration ROM using a jic file, but the configuration fails. What could be the cause?

For 20nm devices, the settings for file generation differ between non-volatile and volatile AES keys. 
Please refer to the following document for file generation procedures.

(Reference) AN 556: Using the Design Security Features in FPGAs 
 

(excerpt) 
Additional step for 20-nm FPGAs only: Turn on Enable volatile security key check box to encrypt the .sof file with volatile security key or turn it off Enable volatile security key check box to encrypt the .sof file with volatile security key or turn it off.

-------------------- 
Category: Programming Configuration 
Tools: Quartus® Prime 
Device: Arria® 10