After several attempts of resolving the "security issue," I pulled the package and config file down to my desktop. When I loaded the package into my solution, BIDS complained about being unable to read or load the config file and warned that it might be corrupted. I couldn't see anything wrong with the file, but on a hunch, I regenerated it from scratch.

And now everything works without a problem.

The problem was in-package connection managers pointing to a defunct server that used to be overridden by the config file until it somehow got corrupted. Go figure.

Thanks for your attempt at helping, though. I appreciate it.