Tonight I just learned the difference between smtps and smtp, along with port 465 versus 587 (for setting smtp_url in mutt). I've apparently been doing things the deprecated way for a while.
'smtps', or 'secure smtp' was a hack - not an official protocol. It's smtp run over an SSL connection, which servers listen on port 465 for. This is still broadly supported, but is deprecated.
The correct way is to use plain old 'smtp' and connect to port 587. This will negotiate TLS after an initial unencrypted connection to the server. This is an actual standard RFC 3207, on an official port. More details are also at wikipedia.
In any case, I have updated all my configs and my mutt examples on the site.