UEFI: clearing secure boot keys?

[Coup27]

I've been a bit ignorant to some of the benefits of UEFI, secure boot and CSM for a while and I've tried to correct that this holiday. I currently have a Win10 installation installed in MBR. Secure boot is enabled in my UEFI and CSM is enabled. Checking my secure boot status in msinfo32 it says my secure boot status is "unsupported" - presumably because I have installed Win10 in MBR and CSM is launching Windows via the "old method". I think that is correct - please correct if not.

Although it's already quick, I've been looking at ways to decrease POST and boot time. The best way seems to be to disable CSM and enable secure boot for UEFI only and install Win10 in UEFI mode. Am I right here?

My grey area comes down to the secure boot keys. I have read up on them but it goes over my head a bit. I have installed a multitude of different Windows / OS's on this PC and I have keys already in my secure keys section. I have backed up these keys onto a USB stick first, but what happens if I delete all my keys?

I am ready to do a clean install of Windows 10 x64 in UEFI mode enabling all the latest mod cons. I want to clear out all my keys and just have whatever is supposed to be there for Win10. Is this what deleting all my keys will do or will it make one big mess?

PC specs in sig.

Thanks.

 

[Compman55]

I would also like an explanation.

 

[VirtualLarry]

I think most BIOSes come pre-installed with the security certs necessary to verify the signed code for MS bootloaders. If you clear the keys, I don't know how hard it is to get a hold of them and re-install them.

Think of them, like the certificate store in a web browser. (They're essentially similar.)

 

[zir_blazer]

You can only use Secure Boot if you're doing UEFI Boot. Windows only supports booting either in BIOS-MBR mode OR UEFI-GPT mode, and the latter is only for 64 Bits versions.
Basically, to get your Windows to boot in UEFI Mode, you need to delete all partitions to let Windows create a GPT Partition Table and an EFI System Partition during the installation.

 

[Coup27]

Further reading has confirmed most of what I already thought. The best combination of features is:

Fastboot........on
CSM..............disabled
Secure boot....Windows UEFI only
Install............Windows in UEFI mode

Regarding the keys, you can clear them in BIOS and once cleared the button changes to "load default keys" which will allow you to bring them back. I think the clear keys is used if you want to load your own keys.