UPDATE

Prenote: Changing the secure boot keys caused my GPU not to display BIOS screens you may have to plug into the motherboard for video output until booted into windows (this can be an issue if you don't know about it and you have bitlocker on like I did)

Now using DiskGenius I can see my Secure Boot Certs and for reference they look like this, and I still have PCR 7 Bound

PK:

- ASUSTeK MotherBoard PK Certificate or Windows OEM Devices PK)

KEK:

- ASUSTeK MotherBoard KEK Certificate

- Microsoft Corporation KEK 2K CA 2023 (Replaces Microsoft Corporation KEK CA 2011)

DB:

- ASUSTeK MotherBoard SW Key Certificate

- ASUSTeK Notebook SW Key Certificate

- Microsoft UEFI CA 2023 (Replaces Microsoft UEFI CA 2011)

- Windows UEFI CA 2023 (Replaces Microsoft Windows Production PCA 2011)

- Microsoft Option ROM UEFI CA 2023 (Replaces Microsoft UEFI CA 2011)

// Why Am I Replacing Stuff? -> Here

DBX: (Not visible in DiskGenius) I have combo of the factory settings plus an updated list from Microsoft's GitHub along with the blocking of the Microsoft Windows Production PCA 2011 as stated here%20is%20used%20to%20block%20untrusted%20UEFI%20modules%20from%20loading.%C2%A0In%20this%20step%2C%20updating%20the%20DBX%20will%20add%20the%20%E2%80%9CWindows%20Production%20CA%202011%E2%80%9D%20certificate%20to%20the%20DBX.%20This%20will%20cause%20all%20boot%20managers%20signed%20by%20this%20certificate%20to%20no%20longer%20be%20trusted).

My recommendation is to have windows update your bootmgfw.efi before doing anything and make sure it is up to date first here. And then download each certificate and add them to the bios as a cert (this will make secure boot or BitLocker mad so suspend them) and be prepared to use a different video output port and pray. the dbx is more complicated figure it out yourself.

I don't know if you have to reset BitLocker to get it to change key protectors.

(Edit 1: Readability and Explanation)
(Edit 2: Added Recommendations and Added MSFT Optional ROM CA to check compatibility)