When your system has secure boot functionality in its UEFI (pretty much every modern x86 system), the UEFI manages the keys used for signing things…
There is the PK (Platform Key) that the hardware manufacturer put into the system on a hardware level …
On top of this sits a “Key Enrollment Key” (KEK) that an OEM puts in place (usually a Microsoft key, but Canonical has such keys too that it puts in place on devices that come with Ubuntu pre-installed (or that Ubuntu enterprise customers put in place when they do not want to trust MS)). That KEK is then used for signing/enrolling other key pairs that can be managed in the " Allowed Signature Database (DB)" and " “Disallowed Signature Database (DBX)” which define what code can be executed by the UEFI before booting
The DB and respectively the DBX hold certificates that validate and invalidate the keys in use, these certs need to be regularly updated …
Security certificates usually have an expiry date so even if they are not accidentally leaked and revoked due to that they need to be replaced eventually since usually certificates are not valid forever on purpose.
The MS KEK key certs from 2011 are expiring this month and need to be replaced by new ones …