Hmm. The datasheet for the ATmega32U4 says (page 360):
Both the Flash and EEPROM memory arrays can be programmed using a serial programming bus while /RESET is pulled to GND. The serial programming interface consists of pins SCK, PDI (input) and PDO (output). After /RESET is set low, the Programming Enable instruction needs to be executed first before program/erase operations can be executed.
If it used SPI it would mention MOSI, MISO, SCK.
Mind you, the documentation is a bit obscure on this point. I had been looking at the ATxmega32A4U which has this note about programming:
The XMEGA doesn’t have the SPI based In-System Programming (ISP) interface for external programming, which has been used for megaAVR. Nor does it have the debugWIRE interface. These have been replaced by a two wire “Programming and Debugging Interface” (PDI). This interface can, as the name indicates, be used for both programming and debugging.
That appears to suggest that SPI and PDI programming are different.
However the documentation for the ATmega32U4 does seem to be closer to the SPI programming model.
A bit more testing reveals that despite labelling the pins as SCK, PDI, PDO, the chip can indeed be programmed using SPI as you said. Ah well, you learn something new every day. I've amended my "chip detector" and "hex uploader" sketches to handle the signature for that chip.