Why does SSIS package fail with invalid signature after migration?

My office just migrated from SQL Server 2008R2 to SQL Server 2017. We converted just under 100 SSIS packages to the 2017 format. We have many of these being triggered by SQL jobs. The large majority of these are running fine after the migration. However, we have a handful (maybe 10) that are sometimes failing with an invalid signature error. For those that are failing, I am not even seeing a consistent 100% failure rate.

Why are the packages failing intermittently with this error?

Below is an example of the full error text. One of the example packages was deployed to 4 different servers, and it runs fine on 3 of them. The only difference between the 4 versions is the path to the dtconfig file. We did not change anything about the jobs that call the packages.

I tried re-deploying the failing package for that example that I just mentioned, but it will still fail intermittently with an invalid signature error. In addition, I had our IT department confirm that the user under which the jobs execute has permissions to read the dtsx file.

Executed as user: domain\username. Microsoft (R) SQL Server Execute Package Utility Version 14.0.3045.24 for 64-bit Copyright (C) 2017 Microsoft. All rights reserved. Started: 6:30:00 AM Error: 2018-12-18 06:30:00.82 Code: 0xC0011007 Source: {5576F0C1-D470-418D-8FAB-9700612AEF76} Description: Unable to load the package as XML because of package does not have a valid XML format. A specific XML parser error will be posted. End Error Error: 2018-12-18 06:30:00.82 Code: 0xC0011002 Source: {5576F0C1-D470-418D-8FAB-9700612AEF76} Description: Failed to open package file "\\servername\sharename\mypackage.dtsx" due to error 0x80090006 "Invalid Signature.". This occurs when loading a package and the file cannot be opened or loaded correctly into the XML document. This can be the result of specifying an incorrect file name when calling LoadPackage or the specified XML file has an incorrect format. End Error Could not load package "\\servername\sharename\mypackage.dtsx" because of error 0xC0011002. Description: Failed to open package file "\\servername\sharename\mypackage.dtsx" due to error 0x80090006 "Invalid Signature.". This occurs when loading a package and the file cannot be opened or loaded correctly into the XML document. This can be the result of specifying an incorrect file name when calling LoadPackage or the specified XML file has an incorrect format. Source: {5576F0C1-D470-418D-8FAB-9700612AEF76} Started: 6:30:00 AM Finished: 6:30:00 AM Elapsed: 0.016 seconds. The package could not be found. The step failed.

A co-worker found a solution that worked for us. We had to update the SQL Server jobs that called the SSIS packages. Instead of referencing UNC paths, these jobs are now referencing local paths. After making this change, we are no longer seeing the errors.

The same job definitions were working under SQL Server 2008R2. However, we did also update our server OS version at the same time, so perhaps that was a factor as well.