I have been trying to find the answer to this, is there a requirement to store the custom keys installed on a SafeBoot UEFI system in flash or otherwise in hard

I have been trying to find the answer to this, is there a requirement to store the custom keys installed on a SafeBoot UEFI system in flash or otherwise in hardware? Are they stored in EBDA or on a disk partition? I can't see how the standard prevents infection by writing a valid bootsector key to the disk otherwise.