Database Key (DB) – This key type is used to sign or verify the binaries (boot loaders, boot managers, shells, drivers, etc.) that UEFI runs.
Forbidden Signature Key (DBX)—The DBX is a sort of anti-trusted keys DB; it contains keys and hashes that correspond to known malware or otherwise undesirable software.
Key Exchange Key (KEK) – The KEK is used to sign keys so that the firmware accepts them as valid when entering them into the database (either the DB or the DBX). Without the KEK, the firmware would have no way of knowing whether a new key was valid or was being fed by malware.
Platform Key (PK) – The PK is the top-level key in Secure Boot, and it serves a function relative to the KEK similar to that of the KEK to the DB and DBX. UEFI Secure Boot supports a single PK.