Microsoft announced the addition of a new Windows Server 2019 feature that will enable admins to enforce Transport Layer Security (TLS) versions by blocking legacy ones via certificate binding.
Microsoft is taking its time with the boot certificate rollout, but you don't have to. Activate the latest UEFI CA 2023 right now.