OK keep them closed. But at least at the bottom of https://debconf18.debconf.org/talks/new/ mention (before he hits the submit button) that
"Your proposal will be held for review and only will be made public if approved." Else it might take weeks for him to find that his e.g., https://debconf18.debconf.org/talks/25/ was giving 403 Forbidden to some users. Indeed the "Any notes for the conference organisers? These are not visible to the public." on the last textbox might lead users to think that proposals are public from the start. So fine, keep the closed policy. But at least on the form state the policy. Indeed, with confidence that their rejected proposals won't be made public, maybe you will get more proposals. Currently submitters don't know if their proposal will be made public once they click submit, or not. So at least tell them, before they hit submit.