Uploading IPA to Testflight error: Invalid IPA, keychain access group

Question

When I try to upload to Testflight, I get the "Invalid IPA: The keychain-access-group..." error. What could I be missing?

I've verified that the application bundle identifier matches in every place I can think of. Archive scheme is set to Release. Here are screenshots of every section I can think of:

Code signing (and no entitlements):

Bundle ID:

In the organizer:

In the Organizer I hit Distribute, then Save for Enterprise or Ad-Hoc, then here's the code signing identity I pick:

Answer 1

My problem turned out to be this: I had set my Code Signing Identity correctly in the Project settings, but it was being overridden in the Targets equivalent. Changing the signing identity under Targets corrected the problem. My mistake -- I just wish there were a clearer message about the problem at some point.