Never mind on this. I got to the bottom of the reason, which is that I didn't yet compile the export templates with my keys. Thought the note on compiling was just relevant if you didn't want to use the precompiled version of export templates, but now I see that it is actually needed so the encryption key can be embedded into that.