I installed the leaked dev version 21996/21996.1 on bare metal and in a VM. Secure Boot didn’t have to be enabled . UEFI and TPM (which requires CSM to be disabled) had to be. Secure Boot - the option only had to be present.
After more testing. I found I could install it in a VM as Legacy. I guess MS laxed on the VM requirements?
I also found on metal, I could disable TPM and enable CSM which should make secure boot completely unavailable. Then I deploy a sysprep-ed Win 11OOBE UEFI image on it without any problems.
I will try pure legacy on metal next…
This was with that leaked dev build so who knows if it was modified or what not and how close it is to the actual dev build release or the final release.