This topic comes right in place to share what I saw on a old computer from 2013.

I read carefully the blog page on the topic: Updating Microsoft Secure Boot keys | Windows IT Pro blog

and the registry key settings: 

https://support.microsoft.com/en-us/topic/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates-a7be69c9-4634-42e1-9ca1-df06f43f360d#articlefootersupportbridge=communitybridge

If I understand properly, the task

Start-ScheduledTask -TaskName “\Microsoft\Windows\PI\Secure-Boot-Update”

is trying to update the UEFI with the new certificates. It is correct?

BUT the whole is missing a critical scenario: what if the UEFI do NOT support the update of certificates?

On my mainboard from 2013, an Asrock Z87E-ITX, with last bios 2.5 from 2018, out of support from Asrock for years already, running the task is having a very strange behavior on Windows 10 Pro:

• if the wifi is off, I get an error 1801 with "Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware"
• if the wifi is on, the computer is freezing completely (exactly 5 min after start, matching the delay of the trigger in the task), nothing is written is any logs, as if the task trying to touch the UEFI will reach a critical address.

In the bios/UEFI on this machine, there is no way whatsoever to manage the keys and certificates. No way to read (and less to write). It seems Asrock did not implement the SecureBoot completely there...
And there is NO TPM chip on that board...

So next question: what if the certificates are not updated in the UEFI? Should not the update within Windows be enough?