The Key Exchange Key (KEK) acts as an authority that allows Microsoft to update the other databases, like the DB and DBX that tell your computer which bootloaders are safe.