I had the same problem, but it wasn't due to a nested web.config
file. Turns out for some reason my deploy user wasn't able to access the key container (in the Web Deployment Service error logs, the exception thrown was System.Configuration.ConfigurationErrorsException: The RSA key container could not be opened.
).
I ended up using this command: aspnet_regiis -pa "NetFrameworkConfigurationKey" "<MYUSER>"
to give <MYUSER>
the necessary access.