We have a small number of remote devices with no local IT support where Secure Boot is currently disabled. Will the KEK and DB updates still be applied to the bios on these devices while Secure Boot is inactive, or does the update process strictly require Secure Boot to be enabled to write the new certificates?