For Secure Boot, the kernel is "signed" with a key. During boot up, Secure Boot checks to make sure that key is valid. Most kernels are signed with Microsoft's key that is preloaded on basically every system. However, not all kernels can be signed with Microsoft's key; if you install a proprietary driver (which you likely selected to during the setup), to continue using secure boot you need to sign the kernel using your own key.
That's what MOK management is for. You are adding your own key to your system to use for Secure Boot.
Personally, I just disable Secure Boot. While it does have some security benefits, it's not worth the headache IMO.