Windows 11 is refreshing Secure Boot keys in 2026. Here's why TPM-WMI Event ID 1801 appears, and how to verify the new certificate.