If I roll out the Intune configuration profile to enable the download of the Secure Boot, would that be sufficient if test cases across our laptop models show promising results?

On test cases across existing computer models in our environment, allowing it to download the latest cert and restart the machines after the task runs shows that most of them are showing the following outputs:

[System.Text.Encoding] : :ASCII.GetSTring( (Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

True

[System.Text.Encoding] : :ASCII. GetString( (Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011'

False

Am I missing anything?