Thanks! Using the --s3-upload-cutoff parameter did fix it. Is there any performance impact to using it?
I was a bit confused by the KMS piece of this -- I had thought things were unencrypted because the bucket's property page on the AWS console said default encryption is turned off, but now I see the properties on individual objects report KMS encryption.