UEFI Secure Boot uses cryptographic checksums and signatures to make sure that the code (typically boot loaders or firmware updaters) which is started by a computer's UEFI firmware can be trusted (i. e. does not contain unauthorized and malicious code).
Most x86 hardware has Microsoft/Windows keys. Thus, in order to install a Linux system, either an extra step is required (add new keys) or Secure Boot must be disabled in the firmware configuration.
Misc
KEK is the Key Exchange Key database, found on the motherboard.