Well this was a bear but I've got it now. The customer support from Pragmatic Works is great. They helped me get the package encryption set correctly. Here's the synopsis.

•I set the Package ProtectionLevel to EncryptSensitiveWithPassword. This is needed so the impersonation doesn’t get dropped in the SSIS package. After setting the Package ProtectionLevel, you enter the password in PackagePassword, which only needs to happen once.

•To make this able to connect to the SFTP site I had to have the SQL job run as the account with access to the SFTP site. I did this by creating a SQL credential and a SQL proxy account.

•I added a proxy to the SFTP connection in Task Factory because the account used to connect to the SFTP was a local account, which can’t get through the firewall between the source server and the SFTP site. We will have to create a domain account for this purpose. Currently it’s using another domain account.

•In the Task Factory tool by Pragmatic Works there is a debug feature. To use the debug feature you right click on a TF component and rename the component by appending “—DEBUG” to the original TF component name. The click on the properties of that component and select “Logging Mode” and choose Enabled. Then click on Log file location and set the name and location of the text file with any error messages.