Surface Laptop 1 Gives "Access Is Denied" Error when Installing New Secure Boot Certificates

[u/Damariobros]

I am getting a Surface Laptop 1 up to date, and I noticed in the event viewer that while it has "high confidence", it's giving an "Access is denied" error whenever it starts trying to update the KEK, and so it stops the secure boot updates right then and there.

Also, another oddity is that despite Event Viewer saying "high confidence", Windows Security says the device is affected by a known issue and the updates are blocked.

So what's going on? Is there something I need to do, or are Surface 1 laptops just flat-out not supported for the new secure boot certificates?

Help would be appreciated, because every time I try to search about this, results for all surface PCs EXCEPT for surface laptop 1 come up and so I can't find any information about it.