acquireTokenSilent() returns an access token signed by the wrong key

I have an SPA that uses MSAL (msal-browser@2.7.0) to authenticate against Azure AD B2C. I call loginRedirect() and everything works as expected. Once the redirect comes back, I save the account information in handleRedirectPromise() and then use acquireTokenSilent() to get an access token to use to call my backend API. This access token, however, is signed by a key that is not one of the keys listed in the JWK key document. I suspect, from research, that maybe I have been given an access token that is supposed to be used to call the MS Graph API, but I do not intend to call that API; I need an access token that can be used to call my backend API. I assume that something is simply misconfigured somewhere, but I've followed every bit of documentation that I can find (most of it is out of date, references MSAL 1.x), and nothing works.

My MSAL configuration is as follows:

const msalConfig = {
    auth: {
        clientId: '96582630-b045-4a92-b798-c1b7448335ad', // (not my real client id)
        authority: 'https://mytenant.b2clogin.com/tfp/mytenant.onmicrosoft.com/B2C_1_signupsignin1',
        knownAuthorities: ['https://mytenant.b2clogin.com/tfp/mytenant.onmicrosoft.com/B2C_1_signupsignin1'],
        redirectUri: 'http://localhost:3000'
    }
};

Login is done as follows:

const loginRequest: msal.RedirectRequest = {
    scopes: ["openid", "profile", "offline_access"],
    extraScopesToConsent: ["https://mytenant.onmicrosoft.com/backend-api/normal-things"]
};

msalInstance.loginRedirect(loginRequest);

Access token is obtained as follows:

let request: msal.SilentRequest = {
    scopes: ["openid", "https://mytenant.onmicrosoft.com/backend-api/normal-things"],
    account: accountInfo // (or null?)
};

msalInstance.acquireTokenSilent(request).then(tokenResponse => {
    accessToken = tokenResponse.accessToken;
}).catch(error => {
    if (error instanceof msal.InteractionRequiredAuthError) {
        // fallback to interaction when silent call fails
        return msalInstance.acquireTokenRedirect(request);
    } else {
        console.log(error);
    }
});

I filed an issue over at the MSAL GitHub repository (https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/2645), they suppose it's an issue with B2C.