Can Microsoft provide clarity on when the 2011 Secure Boot certificates will actually be revoked in the UEFI dbx? Am I correct that revocation—not expiration—is what will prevent systems from booting if they don’t already have the updated 2023 certificates applied?