If you want to enforce TPM and Secure Boot - do it NOW, before Go-Live.

Don't do it after people start playing and THEN enable it - you'll get hit with a lot of backlash. Make it clear that TPM and Secure Boot is a requirement on the Steam Store, and allow refunds for anyone who can't enable it. Enable it sooner than later, because legally you won't be able to enable it after people buy the game under the premise that their hardware requirements were met (this is a hardware requirement).

Update steam store, allow refunds BEFORE the game launch. Do it.