You've granted the service account rights to act on behalf of your users. Now the service account needs to act as a user in your domain with rights to perform signature updates for all users, in other words, it needs to act as a super admin. Try adding:
.setServiceAccountUser(userEmail)
where userEmail is the email address of a super admin within your Google Apps instance. A good walkthrough for this is in the Admin SDK documentation.