Sigh. Apparently posting here makes my brain work.
When I would click on the details icon (in the management -> reporting area) for the failed reports, I noticed the "Processed By" node was.....not one of my two Kibana nodes. Discovered someone had installed another copy of Kibana in our cluster to test something, and that node was picking up the reporting jobs (and of course, it did not have the same encryptionKey settings).
Test server nuked, everything works now. 