How to diagnose the error "Invalid Signature" returned by a SAML IDP (Azure B2C Custom Policies) on SP initiated SSO - saml

Question

I have followed the guides on setting up Custom Policies in Azure B2C to allow it to function as a SAML IDP. I have given that metadata to my SP application (CompleteFTP) and attempted to perform SP initated SSO.
The AuthNRequest is formulated by the SP application and signed. This is then redirected to the IDP via the client browser.
A response is generated and returned by the IDP before any user flow takes place.
<samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"/>
<samlp:StatusMessage>Invalid signature.</samlp:StatusMessage>
<IsPolicySpecificError>false</IsPolicySpecificError>
</samlp:Status>
So this seems fairly obvious what is going on, the urn:oasis:names:tc:SAML:2.0:status:Requester is the IDP blaming the SP and stating that it sent an Invalid signature. in its request.
The problem is I can't really find where to go from here!
What I've attempted so far:
Hooking up Application Insights to get the Journey Recorder traces (see below) = same error and not much new detail
Using a different SP to make another request = same error
Using this SP with a different IDP = so far inconclusive but pursuing
Using this SP with Azure AD SAML 'Enterprise Apps' = Works first time, I think because that IDP doesn't care about signing?
Using same Azure B2C tenant with an OpenID flow/app = Works OK
Regenerating the various signing and encryption certs used by Azure B2C SAML setup = same error
Copy/pasting the SP metadata into the Azure B2C custom policy file instead of referring to it by URL = same error
After pasting, messing with the SP metadata to reverse the order of signing certificates (there are 3 that look like a chain) or including only 1 at a time = same error
At the moment, this seems to suggest that there is an issue with the signature validation used by the Azure B2C SAML IDP flows, but how can that be? Others have this working!
Journey Recorder excerpt:
{
"Kind": "Predicate",
"Content": "Web.TPEngine.StateMachineHandlers.InitiatingMessageValidationHandler"
},
{
"Kind": "HandlerResult",
"Content": {
"Result": false,
"RecorderRecord": {
"Values": [
{
"Key": "Validation",
"Value": {
"Values": [
{
"Key": "SubmittedBy",
"Value": "Application"
},
{
"Key": "ProtocolProviderType",
"Value": "SamlProtocolProvider"
},
{
"Key": "Exception",
"Value": {
"Kind": "Handled",
"HResult": "80131500",
"Message": "Invalid signature.",
"Data": {
"IsPolicySpecificError": false
}
}
}
]
}
}
]
}