How do I set the machineKey for a Cloud Service running in Azure?

Question

I am testing the scale-out capabilities of our Azure Cloud Service by moving from one running instance to three. We are using Standard_A2 nodes, a WorkerRole and SignalR for Client-Server connections.

After doing this, any inbound SignalR connections return 400 "Bad Request" HTTP errors. Reverting back to a single instance gets rid of the problem and the client-server interactions work normally again, so the scaling is definitely the cause of the problem. Here is the error:

Microsoft.AspNet.SignalR.Client.HttpClientException: StatusCode: 400, ReasonPhrase: 'Bad Request', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
{
Transfer-Encoding: chunked
Server: Microsoft-HTTPAPI/2.0
{
Transfer-Encoding: chunked
Server: Microsoft-HTTPAPI/2.0
X-Content-Type-Options: nosniff
Date: Wed, 24 Dec 2014 09:16:32 GMT
}
  at Microsoft.AspNet.SignalR.Client.Http.DefaultHttpClient+<>c__DisplayClass6.<Post>b__5 (System.Net.Http.HttpResponseMessage responseMessage) [0x00000] in <filename unknown>:0 
  at Microsoft.AspNet.SignalR.TaskAsyncHelper+<>c__DisplayClass19`2[T,TResult].<Then>b__17 (System.Threading.Tasks.Task`1 t) [0x00000] in <filename unknown>:0 
  at Microsoft.AspNet.SignalR.TaskAsyncHelper+TaskRunners`2+<>c__DisplayClass3a[System.Net.Http.HttpResponseMessage,Microsoft.AspNet.SignalR.Client.Http.IResponse].<RunTask>b__39 (System.Threading.Tasks.Task`1 t) [0x00000] in <filename unknown>:0

I have inspected the ResponseBody of these errors (using HttpClientExpection.GetError().ResponseBody), and can confirm that this returns "The ConnectionId is in the incorrect format.". This would indicate that the problem arises because the machineKey is not the same across the three running instances (see this, for example: SignalR with Redis Backplane Behind F5 - StatusCode: 400, ReasonPhrase: 'Bad Request').

I have added a machineKey element to the config file (in system.web) as follows, and redeployed:

<machineKey validationKey="FIRST_KEY"  
        decryptionKey="SECOND_KEY" 
        validation="SHA1" decryption="Auto" />

There was no change to the response from the server(s). I also tried setting decryption="AES". No change.

Despite extensive searching, there does not appear to be any clear guidelines out there for how to deploy with a single machineKey. What is my best next step? Or am I going in completely the wrong direction?