Whoops, that is my bad. ACL settings on Amazon S3 don't always propagate like I expect, this is something I'm still getting used to from the last few days. I had checked that the Xml file was working fine, but the actual update package itself wasn't. It's all good now, though -- sorry for the confusion!