I’ve just discovered a subtlety that isn’t documented anywhere that I could find.
If an Administrator is in the server document as a “Database Administrator” they cannot sign databases with the server ID, regardless of the level of access they have to the database. The error is “You are not authorised to perform that operation”
If that Administrator’s access is bumped up to the “Adminstrators” field on the server document (I am referring to the Security tab - just to be clear) then they can sign a database using the server ID.
Since I couldn’t find this detailed anywhere I wanted to post it in case someone else comes up against the same quirk.