Hello Rylos
Welcome to Communities and vSAN.
"---2 x 500GB nvme SSD. I didn't realize I couldn't use two separate cache drives unless I have more than one spinning disk. Lesson learned, can't raid, oh well."
Only one cache-tier device per Disk-Group - you could however go with less capacity and better performance and use NVMe devices for both capacity-tier and cache-tier - either way though if this is hardware that is not on the HCL and/or nested then don't be expecting the world with regard to performance and/or potential reliability.
"-Two identical servers running 6.7.0 build 10764712"
"-Witness appliance running 6.7.0 Update 1 (Build 10302608)"
Update your Witness to the same build as your hosts - just because the Witness is an appliance doesn't mean it should be neglected as it is a vital part of the cluster what with being its own Fault Domain.
You never mentioned what build your vCenter is on, if it is 6.7 pre-U1 then upgrade before attempting anything - while 'ESXi' 6.7 U1 + vCenter 6.7 GA are a supported configuration, vSAN 6.7 U1 and vCenter 6.7 GA are not as too much changed and various issues can be encountered even during attempts at initial configuration.
Step 5 as per the 6.7 UI client is claiming the Witness Appliance disks, do you see literally *nothing* or do you see a screen with no disks available for claiming?
You also failed to mention how the Witness has vsan/witness traffic configured, but then again Step 4 in the UI configuration wizard should prompt and not allow selection as cluster Witness if no vmk is enabled for vsan traffic.
"Hosts and witness can talk to each other on all subnets."
The proper way of checking this requires you validate they can communicate over the required interfaces at the configured MTU and on the required port
# vmkping -I vmkX <Dest-IP> -s 1472 -d
If using jumbo-frames:
# vmkping -I vmkX <Dest-IP> -s 8972 -d
And should see communication when joining cluster on this:
# tcpdump-uw -i vmkX udp port 12321
"Tried this in chrome and IE11, same thing. Edge, can't even get past step 2 as the next button is gone completely. Firefox, same thing, no next button on step 2."
Have you only attempted this in the UI client or the FLEX/Flash Client also?
It is also relatively trivial to configure a cluster without vCenter aswell if you want to rule out this aspect:
VMware vSphere 6.5 Documentation Library
Bob