UEFI Secure Boot keys will expire in June 2026 which means Microsoft can no longer sign with them. Machines will continue to boot as long as the current public keys are not removed from db or revoked by dbx. Fedora Rawhide contains a dual-signed first stage boot loader.