Area-51 AAT2250, Drive Encryption not available?

Was hoping to encrypt my drives but I don't have the encryption option.

Under System Information it says:   Reason for failed automatic device encryption: PCR7 binding is not supported, un-allowed DMA capable bus/devices(s) detected?

The machine has the  2TB PCIe M.2 NVMe Opal 2.0 Self Encrypting Gen 5 drive.

I have to imagine a setting is wrong cause I can't believe a $4000 computer wouldn't let you turn encryption on...

Any suggestions?