Tom, with regard to "The Mystery of the Working Network Location Server that Did Not Work" you did not say what you did to solve the problem. We have this exact behaviour on an IIS server. As per your list:
•Certificates – check
•Network Location Server – check
•DA client and server GPOs deployed – check
•Infrastructure and intranet tunnels established when DA client outside the name – check
•Security Groups for DA clients – check
NLS is accessible via a browser but after ~20 seconds the client fails inside/outside detection and attempts to establish the tunnel