M1 Mac (in DEP) first created user has no Secure Token
After much experimentation, it looks like the way to do this is to go to Recovery mode, and &quot;Erase this Mac&quot;. I also used &quot;Deactivate this Mac&quot;, but I am not sure if this helped or not.
After erasing the machine, and then reformatting and reinstalling (the classic nuke and pave), when macOS finished installing the single user on the system DID have a Secure Token, and I was able to enable FileVault.
It really shouldn't be this difficult, though.