Yes, but that duty only falls on whoever is distributing the code to the user in question. If a computer requires a signed GPL image to boot, then whoever distributed the computer with the GPL software on it has to provide the key. Nobody else is a party to this. If a vendor distributes GPL code and requires it to be signed by a key they don't have, then they've exposed themselves to legal liability with no remedy short of issuing new hardware.
How is Ubuntu a party to what some hardware vendor does with their software, unless they paid them to do it?