We need to do some more testing of applying dbx updates to existing systems that already have a set of certificate hashes in that variable.