Isn't tls1/1.1 disabled anyway? Because PVE7.2 is based on Deb11 and it's openssl.conf has set
MinProtocol = TLSv1.2
Hmm, it looks, postfix doesn't honor openssl configuration.
SOMEHOST:~$ openssl s_client -connect PMG:25 -tls1
CONNECTED(00000003)
140408873498256:error:1408F10B:SSL...