1) What is level of confidence that devices that cannot update their certificate will remain functional. Has it been tested somehow?

2) Any concerns with Registry key for enabling secureboot certificate updates being set on devices that are not able to update it (out of support devices that will not get a firmware update).

3) How quick should we expect to see BIOS updates for this to be made available in WUfB? Seems like there are a lot missing in our fleet

4) Will a device that does not get the latest secureboot certificate, still receive monthly cumulative updates if it is on a supported OS?

5) Any other impact/risk to devices that are not able to update their SecureBoot certificate?

6) Are there other mitigations we can take in our environment to ensure devices that cannot get the certificate are less vulnerable?