TLDR make sure your system time is correct in Windows & BIOS
Ok, this has been well documented around the internet, and the typical answer is:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12Powershell Invoke-WebRequest Fails with SSL/TLS Secure Channel – Stack Overflow
However today I was really annoyed because that was already built into my script, and I was getting the same error on an older machine I just pulled out of storage.
Issue was… TIME! The system clock in the BIOS was reset back to 2016, as the battery on the motherboard has died. So, I updated the time in the BIOS menu, then booted back into WinPE, and this time my scripts (OSDCloud) worked as expected.