Presumably you have to sign a pkek key with the firmware key. Even then, you don't actually have full control of your OS's kernel, so it may not be easy to insert a key.