For devices currently sitting in vendor storage awaiting deployment, do we need to update all of them before June?

For example, if a device remains in storage until the end of the year and is then shipped to a user, would we still be able to update the Secure Boot Certificate by scoping that device into the remediations? Or would the certificate be too far expired at that point to be remediated if the BIOS is up to date?