There are two ways to edit the key databases: 1. Without Secure Boot they're open to whatever you want to write. 2. With Secure Boot, they're open to whatever

There are two ways to edit the key databases: 1. Without Secure Boot they're open to whatever you want to write. 2. With Secure Boot, they're open to whatever you want to write, as long as it's signed with a key that's trusted by the current database. So if you can't disable Secure Boot, you need to ask Microsoft to sign your key data, before you can add it. Might as well request a directly signed key (within the MS trust chain) then - from there, you can also overwrite things to honor a new trust chain, and Microsoft is probably more used to requests of this kind than to the other.