You cannot sign your B2s. Well, you can, but it wont help. What the error should say is the B2 "requested a permission that only B2s signed by Bb are allowed to have."
I guess it's time to audit my B2s and see if they need the permissions to function and what the alternatives to how I'm using them are (if any).
Which will probably mean moving to using DAO for most things rather than grabbing a Db connection directly.