"If you can mess around in the BIOS you can just enroll your own keys"

... and if your corporation has locked down the UEFI controls to prevent this, you can't. Forex: corporate Microsoft Surface, locked down with Intune (and Autopilot), you won't be getting far enough to do that.