The KEK databases are regularly updated … see a recent discussion here when recently the older MS keys got replaced:
As long as you keep your Ubuntu system up to date you should always get the correct keys and bits needed …