Microsoft’s Secure Boot certificate transition is moving from background maintenance into an operational project that enterprises now have to manage deliberately. The short answer to your two questions is: use Microsoft Intune as the primary deployment mechanism, not a registry hack plus...