Set "db" variable in secure boot setup mode still requires generating PKCS#7?

["David F." <df7729@gmail.com>]

Hi,

Had a fairly simple task of wanting to install the latest MS .crt
files for KEK, and their two files for the "db" (the Windows CA and
UEFI CA) in a system placed in setup/custom mode.  However, even
though it seemed to take the KEK, it never took the "db", always had a
problem on a DH77KC mobo (dumped data headers looked as expected).
Now when I constructed it, I thought I could leave out any PKCS#7 data
(set the expected CertType but in the Hdr dwLength only included
CertType and not any CertData), but looking at the algo in UEFI Spec
2.6 page 245, it looks like we'd always have to generate the hash,
sign it, create all the PKCS stuff even in setup mode?    That would
surely unnecessarily bloat any apps that really only need to update
things in setup mode wouldn't it?   So to confirm, that is a
requirement even in setup mode?    If so, why?

TIA!!