In case you missed it in the February KB5077241 update, Microsoft quietly added two new PowerShell cmdlets for Secure Boot verification:
Get-SecureBootSVN - checks the Secure Version Number of your firmware and bootloader and reports compliance status. This tells you whether your device is protected against boot manager rollback attacks (CVE-2023-24932).
Get-SecureBootUEFI -Decoded - finally displays Secure Boot keys and certificates in a human-readable format.