Immediately after, in the debug log, there is another error about SqlBagOStuff

[MessageCache] MessageCache using store SqlBagOStuff
[DBQuery] SqlBagOStuff::fetchBlobMulti [0s] db: SELECT keyname,value,exptime FROM objectcache WHERE keyname = 'pega:messages:en'
[DBQuery] SqlBagOStuff::fetchBlobMulti [0s] db: SELECT keyname,value,exptime FROM objectcache WHERE keyname = 'pega:messages:en:status'
[DBQuery] SqlBagOStuff::lock [0s] db: SELECT GET_LOCK('pega:messages:en', 0) AS lockstatus
[SQLBagOStuff] SqlBagOStuff::lock failed due to timeout for pega:messages:en.

I finally solved this. While Apache will run fine if you just provide a certificate key and the service certificate, the OpenIDConnect client (and apparently VisualEditor too) run their curl requests as an unprivileged user (www-data). So, you must configure Apache with an intermediate certificate chain file too.

		SSLCertificateFile	/etc/ssl/private/gd-ucc-wiki.pega.com.crt
		SSLCertificateChainFile /etc/ssl/private/gd-ucc-bundle-wiki.pega.com.crt
		SSLCertificateKeyFile /etc/ssl/private/gd-ucc-wiki.pega.com.key

And, those files must be readable by www-data, so although the directory given in my example above says 'private' I had to chmod a+x the directory (which was previously mode 0600)

I guess this took me so long to realize because my Apache error logging was so verbose so as to render it useless, and I was focussed on the messages coming from Visual Editor instead of the MediaWiki logs. (Had to turn off the job queue because that was filling debug.log faster than you can read.)

cicalese: For the curious, there is a pretty good error message from Pluggable Auth

[PluggableAuth] Class name: OpenIDConnect
Jumbojett\OpenIDConnectClientException: Curl error: error setting certificate verify locations:
  CAfile: /etc/ssl/private/gd-ucc-wiki.pega.com.crt
  CApath: /etc/ssl/certs in /var/www/html/vendor/jumbojett/openid-connect-php/src/OpenIDConnectClient.php:1052