What is the role of Key Exchange Keys (KEKs) in UEFI Secure Boot?
The owner of the certificate in KEK can update the DB and DBX, which is usually the OSV. The owner of the certificate in PK can 
update the KEK. If the image is signed by a key in DB, then it is allowed to run. If the image is signed by a key in DBX, then it is 
forbidden to run.
Below is an instruction that describes a task. Write a response that appropriately completes the request. ### Instruction: What is the role of Key Exchange Keys (KEKs) in UEFI Secure Boot? ### Response: The owner of the certificate in KEK can update the DB and DBX, which is usually the OSV. The owner of the certificate in PK can 
update the KEK. If the image is signed by a key in DB, then it is allowed to run. If the image is signed by a key in DBX, then it is 
forbidden to run. 