Encrypted config section plus BCL.Build - asp.net

Question

I'm trying to update LinqKit in an ASP.Net 4.0 Web Application which uses encrypted config sections to obfuscate the connectionstrings section. We also use config transforms.
<?xml version="1.0" encoding="utf-8"?>
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
<configProtectedData>
<providers>
<add keyContainerName="FooBarKeys" useMachineContainer="true" description="Uses RsaCryptoServiceProvider to encrypt and decrypt" name="FooBarProvider" type="System.Configuration.RsaProtectedConfigurationProvider,System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
</providers>
</configProtectedData>
<connectionStrings configProtectionProvider="FooBarProvider">
<EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns="http://www.w3.org/2001/04/xmlenc#">
...
For projects targeting .Net 4.0, LinqKit 1.1.7+ depends on Microsoft.Bcl.Async, and Microsoft.Bcl.Build is required in any projects referencing class libraries which use Microsoft.Bcl.Async.
When I build, I get this error:
The "EnsureBindingRedirects" task failed unexpectedly.
System.Xml.XmlException: App.config must have root configuration element. Line 2, position 2.
at Roxel.BuildTasks.EnsureBindingRedirects.ThrowXmlException(String message, Exception inner, IXmlLineInfo info)
at Roxel.BuildTasks.EnsureBindingRedirects.LoadAppConfig(String appConfigPath)
at Roxel.BuildTasks.EnsureBindingRedirects.Execute()
at Microsoft.Build.BackEnd.TaskExecutionHost.Microsoft.Build.BackEnd.ITaskExecutionHost.Execute()
at Microsoft.Build.BackEnd.TaskBuilder.<ExecuteInstantiatedTask>d__26.MoveNext()
File: packages\Microsoft.Bcl.Build.1.0.21\build\Microsoft.Bcl.Build.targets line 97
If I change <configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0"> to <configuration>, I get XML validation warnings for web.config:
The 'keyContainerName' attribute is not allowed.
The 'useMachineContainer' attribute is not allowed.
The 'description' attribute is not allowed.
The 'configProtectionProvider' attribute is not allowed.
The element 'connectionStrings' has invalid child element 'EncryptedData' in namespace 'http://www.w3.org/2001/04/xmlenc#'. List of possible elements expected: 'add, remove, clear'.
I tried using <configuration xmlns:c="http://schemas.microsoft.com/.NetConfiguration/v2.0">, with <c:configProtectedData> and <c:connectionStrings>. This validates, but fails at runtime:
HTTP Error 500.19 - Internal Server Error
The requested page cannot be accessed because the related configuration data for the page is invalid.
Error Code 0x80070032
Config Error The configuration section 'c:configProtectedData' cannot be read because it is missing a section declaration
Config Source:
5: </configSections>
**6: <c:configProtectedData>**
7: <providers>
How do I use these libraries in a .Net 4.0 Web App such that it builds, has a valid web.config and runs?