This is an additional note for the same problem: The xmlrpc.php file is readable and will execute as is proven by a curl call like this:
$ curl https://wp.example.com/xmlrpc.php
XML-RPC server accepts POST requests only.
The content staging key was generated on the staging server using the CS plugin and copy/pasted to the production server to guarantee that they match.
The security on this server is very tight.
