if we update the PK file via efi for vmware guest os, is there a future update for updating KEK since its not occurring? some coordination between microsoft and broadcom on this? or do we need to apply the KEK manually via the efi then I see it going to status Updated.

what is the best way to validate systems are completed, just be in Updated status?