H610M-HVS/M.2 R2.0 Secure Boot not active

OK, so this is a far more complicated issue than it should be. Personally, I feel
it should have been handled better by Microsoft. Let's go over a list of things
to check:

1. Have you updated your BIOS to the latest version available?
https://www.asrock.com/mb/Intel/H610M-HVSM.2%20R2.0/index.asp#BIOS
You should be on version 11.01 that includes the new keys

2. Is your OS installed on a GPT partition?
In Windows, right-click Start -> Disk Management
Right-click your main disk -> Properties -> Volumes
Check Partition Style: It must be GPT, not MBR

3. If you have verified the above you can try resetting your keys:
Enter BIOS/UEFI (usually F2 or Delete)
Navigate to the Secure Boot configuration section
Change the Secure Boot mode from Standard to Custom
Select the option to Restore Factory Keys or Install Default Secure Boot Keys
Change the mode back to Standard

I don't use SB on most of my systems outside of the ones I use for work/banking
etc. That said, being as secure as possible is never a bad idea.

Based on your description I suspect you have not updated your BIOS yet.

Good luck

CSM should be disabled. Enabling it will prevent secure boot from working.

As for BIOS updates, make sure you restore factory defaults and restart the system
before updating. Make sure the system is not powered off during the flash procedure.
The system will prompt you to restart when done. Your board does not appear to have
a BIOS flashback function so caution is always advised when updating. The odds
of something going wrong are extremely low but any interruption (power, hitting
reset etc) can cause it to fail and render the motherboard useless. It can be
recovered if it fails but will require either taking it to a qualified service
center or buying and learning to use a ROM flasher device. I am not trying to
scare you, just give you some pointers on what to avoid and what precautions to
take to ensure a smooth update. I will break it down in steps so it's easy to
follow:

1. Download the BIOS file from your product page
2. Extract the .zip file to a FAT32 formatted flash drive, ideally with nothing
else on it to save you having to wait while the BIOS searches it's contents
3. Enter the BIOS and "Load UEFI Defaults" then save and exit
4. I usually boot back into windows and shut down from there at this point
5. Boot back into the BIOS, insert your flash drive into one of the black USB
ports on the back panel of your motherboard.
6. Navigate to instant flash and follow the prompts. Once complete the system
will reboot.

If all went well (which it should) you will be updated and ready to try enabling
your Secure Boot.

There is no reason it should give you any issues, failed flashes are very rare
but I didn't want to leave you with the impression that it is impossible for it
to cause a major issue.

Good luck