FreckleEye @support13
Even though my knowledge about Secure Boot is limited, I think what Beelink needs to do is deploying their own Secure Boot keys. This steps can also be done by customers with the difference that the files are not integrated in a UEFI update image but installed via the UEFI settings.
The involved private keys must be stored in a way that ensures that they may never be leaked.
If Beelink ship their own keys, they then also are responsible for updating the DB and DBX files whenever it is necessary. These updates don’t have to be in form of UEFI updates and can be distributed as signed files.
Some useful documentation:
