Not inherently. It's actually reasonably hard to do - inserting new keys requires that those keys themselves be signed by the private half of one of the keys in the KEK database, so you'd need to give your key to someone who *does* have an entry there (either the OEM or Microsoft), have them sign it and then pass that into the variable database.