Update: I get the same 400 Bad Request for my personal AppstoreConnect account with a different vendor number and private key. So this problem doesn't seem to be account specific.