Actually, the Logo requirements specify that you must be able to add your own keys:
> It shall be possible for a physically present user to use the Custom Mode firmware setup option to modify the contents of the Secure Boot signature databases and the PK.