[racket] OS X pkg error, tcp-connect "operation not permitted" -- maybe gatekeeper?

I have a student for whom package install is failing like this:

tcp-connect: connection failed
 address: pkg.racket-lang.org
 port number: 443
 step: 6
 system error: Operation not permitted; errno=1
 context...:
  /Applications/Racket v5.3.6/collects/openssl/mzssl.rkt:1431:0: ssl-connect
  /Applications/Racket v5.3.6/collects/net/url.rkt:222:2: redirection-loop
  /Applications/Racket v5.3.6/collects/pkg/util.rkt:33:0: call/input-url+2005
  /Applications/Racket v5.3.6/collects/pkg/lib.rkt:226:3: for-loop
  /Applications/Racket v5.3.6/collects/pkg/lib.rkt:224:0: package-index-lookup
  /Applications/Racket v5.3.6/collects/pkg/lib.rkt:459:2: install-package228
  /Applications/Racket v5.3.6/collects/pkg/lib.rkt:449:0: install-packages55
  /Applications/Racket v5.3.6/collects/racket/file.rkt:295:8
  /Applications/Racket v5.3.6/collects/racket/file.rkt:284:0: call-with-file-lock24
  /Applications/Racket v5.3.6/collects/mrlib/terminal.rkt:150:7
  /Applications/Racket v5.3.6/collects/mred/private/wx/common/queue.rkt:451:6
  /Applications/Racket v5.3.6/collects/mred/private/wx/common/queue.rkt:502:32
  /Applications/Racket v5.3.6/collects/racket/private/more-scheme.rkt:146:2: call-with-break-parameterization
  /Applications/Racket v5.3.6/collects/mred/private/wx/common/queue.rkt:397:18: loop


My guess is that errno=1 wouldn't be related to connectivity problems, but that the OS is actually rejecting the tcp-connect. I'm wondering if this could be related to gatekeeper?  I'm going to tell my student to run through the gatekeeper enable-permissions rigamarole, but I thought that we didn't have that problem any more.

Also, I have no idea what "step: 6" means.

Any advice appreciated!

John