As far as I know, when doing a bake(&sign) only agents that really need a re-bake (because of config/version changes) are actually re-baked and the others stay untouched.
So maybe in fact it does not work for you too, and “not all agents were signed” actually means none of the really “re-baked” agents were signed?