When updating Secure Boot certificates on Linux, fwupdmgr may fail while writing a UEFI Key Exchange Key (KEK) update. This has been observed on systems such as the AMD-based Lenovo ThinkCentre M715q, but similar symptoms can occur on other Lenovo firmware and are not specific to AMD.
Running fwupdmgr upgrade --force may fail with:
Upgrade KEK CA from 2011 to 2023?