KB5012170: Security update for Secure Boot DBX

[eyal]

In the UEFI BIOS, you need to disable Secure Boot or clear the DBx database to remove the blacklist keys added by Windows Update.

Is this a workaround while waiting for a proper update or a permanent solution? It is not described in the "About Secure Boot" doco where the old "enroll" instructions were removed.

I would rather not disable secure boot.
How do I clear a key in the DBx database (and which key should I disable)?

TIA