KEK updates

• PK signs KEK
• KEK signs DB and DBX
• Existing KEK keys also expired:
• Microsoft KEK CA 2011 (June 2026)
• Also update KEK on your machines
• Fwupd again