FYI, the create wizard got some new additions in the latest pve-manager (7.0-13) that is available on pvetest at time of writing:
View attachment 30069
With that one can create a TPM there directly (also possible to add on existing VMs via their Hardware tabs "Add -> TPM" button)
Further, with a newer qemu-server one can select if the EFI-vars template should contain pre-enrolled keys (from Linux distros and Microsoft) with Secure boot enabled:
View attachment 30070
Those two things setup allow an up-to-date Windows 11 installation in a VM (note Windows 11's increased minimum requirements on memory/storage space).
If one then installs win11 only to install Firefox and open the same PVE interface the VM is installed on and opens the console for proof, one can get a nice infinite-mirror
View attachment 30072