Yeah, you did discover the issue, and the error does an okay job at explaining what’s happening. Signatures from canisters on the mainnet cannot be used locally, or vise versa. This is what the JS Agent is doing when you call fetchRootKey for local replicas - the root key of the network is needed to verify signatures.
Here are the docs from the II repo - GitHub - dfinity/internet-identity: Internet Identity, a blockchain authentication system for the Internet Computer