It should be just "hey, do you trust this install media" -> "yes" -> boot key is automatically added at this step.
Instead the whole ecosystem is at microsoft whim
Not to say that having Microsoft as the custodian of the keys preloaded on all PCs is the optimal solution, but I don't think a token yes/no to add any random key on boot is a good idea either.