It turns out: It's config-template wide. In hindsight, this was the obvious answer anyway; a classic example of not seeing the forest for the trees. Group Policies and iPSK entries are configured on the SSID at the config-template level, not on the network that is bound to said config-template. My apologies for reducing the signal-to-noise ratio.
... View more