Do i Understand this correctly.  Event ID 1801 means that my device has the new Certs, but only at the OS level.    So that technically means my device has and is using the new Certs?  

BUT if i want the EXTRA peace of mind and avoidance of accidentally losing those certs due to someone changing something in BIOS, i need to fully bake them into BIOS via a Firmware update.  And that would give me an 1808 ID?  

So both IDs mean i have, and am using, the new Certs.  But one is more robust than the other?