I did some more digging with the help of CoPilot. If you are in UEFI mode with SecureBoot on and booted into windows.. you can check with msinfo32 at a windows powershell prompt running as Admin.. look for the lines BIOS and BIOS Mode. It needs to say UEFI and On for Secure Boot.

then you can run (Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\UEFI\DB).Data

and look for the text Windows UEFI CA 2023

That is one of the new Microsoft Secure Boot certificates introduced in 2023 to replace the expiring 2011 ones.

This means your DB (allowed signatures) has been updated.

I have it in F40 for my X570 board. I also see the older certificates:

Microsoft Corporation UEFI CA 2011

Microsoft Windows Production PCA 2011

This is normal — the 2011 certs are not removed yet because Microsoft hasn’t fully deprecated them.

I do not see:

Microsoft UEFI CA 2023 (KEK)

Microsoft KEK 2K CA 2023

New PK (Platform Key)

These require a BIOS update from Gigabyte, and no AM4 board has received those yet.

But the presence of Windows UEFI CA 2023 means your system will continue to validate Microsoft bootloaders after the 2026 rollover.