Well, I uninstalled 3.2.3 and re-installed Xcode 3.2.2, and that makes it sign without error.
Of course, since I made the mistake (as a part of trying to figure out what was going wrong here) of upgrading my phone to 4.0b, I can no longer test the app on my phone, because only 3.2.3 will talk to the 4.0 iPhone OS. And apparently downgrading your phone back to OS 3.1.3 is an even more convoluted and flaky process than jailbreaking it.
But, it seems to have uploaded to the store and has "changed state to In Review", so we shall see if that means it made it past the DRM filter.
