#SecureBoot isn't secure if you need to disable it to boot your computer. Key expiration isn't an inherently bad idea, but there needs to be an easy way for every, including non-technical folks, to add updated keys to their computer's firmware (including computers no longer supported by the manufacturer), and to verify the keys come from a trustworthy source and will allow their computer to continue booting as normal.