Karl-WE​ 

You have asked a lot of the questions I would have wanted answers to and more!

I have not seen Microsoft publish answers to the questions you ask, let's hope we can learn more at the AMA

This looks, like a lot of work for a lot of people to resolve all the issue arising from getting all our Secure Boot certificates updated.

Yesterday when I first heard about this after reading an email. I thought I would kick thing off by running the script on work laptop. So, my laptop which is only 2 years old does need its certificate updating. Now I spent a good few hours trying to update the certificate, but my laptop is stuck 'InProgress' and from all the research I have done it looks like a repair install is the only way it can be fixed.

So now I have another 53 client devices and 6 servers to check over and resolve. Due to a lack of budget where I work, we still have few client computers running Windows10, thanks a bunch Microsoft for keeping me in Job!