Solved! At last!
I cannot say exactly which step was the key, so here are most of the steps I took. Hopefully this helps someone.
1. Took the steps in Invalid or incorrect Certificates including reboot.
2. Took the steps in Edit your Keychain including reboot.
3. Downloaded and manually reinstalled Security Update 2015-004.
4. Repaired permissions and directories with Recovery reboot.
5. Took the steps in Invalid or incorrect Certificates including reboot.
6. Took the steps in Edit your Keychain including reboot.
I've gone through some of these steps multiple times, just hoping it would work that time...
Today -- when I went into Mail.app, it whined about the certs for me.com servers -- so I made *that* always trusted. And this time, iTunes.app didn't complain about any certs! And this time, Software Update.app didn't complain about any certs! And it successfully applied the three-week delayed updates!
So I'm hoping it's all done and done. OMG, frustrating along the way!