Solved by TAC. When I upgraded to 7.0.5 on my gates, or maybe on an earlier upgrade, the following config got set:
config switch-controller global
set fips-enforce enable
Well FIPS can cause all sorts of issues and often breaks stuff. We set that to disabled, and while it took a little time to take effect, I no longer see that cryptic error. Whew!