You're right! And now I qualify for the win 11 beta. Looks like I got confused between two different security setting pages in the UEFI menu, and had just enabled "the ability for it to use a TPM plugged in to the header" instead of enabling PPT like I thought I was doing.