Well, agent baking gave errors, something related to some ‘server’ tags, not going to paste the huge log here, it’s almost guaranteed to bore the hell out of anyone.
For another host, I had to temporarily bring in an agent that did not use transport encryption, so I modified the agent setting before baking - miracle, it worked! Then restored the setting to enforced encryption, baking and signing started to work in this case as well.
I am thankful for this, not going to investigate further, too little time for this unfortunately.