Microsoft’s staged refresh of the Secure Boot signing chain is working exactly as designed — it is a phased, telemetry-gated update that may produce informational TPM‑WMI events (including Event ID 1801) and transient “under observation” messages in Event Viewer, but those logs alone are not a...