Okay, after some fiddling, I managed to do it on the command line. It was relatively trivial once I figured out how to tell gpg2
which key to use to sign the other key.
gpg2 -u <key-ID> --sign-key <user@domain>
where <key-ID>
is the ID of the key with which to sign and <user@domain>
is one user identity or the key ID of the key to sign. I.e. basically: gpg2 -u SIGNER --sign-key SIGNEE
...
This is a limitation of the Enigmail user interface, so command line seems to be a reasonable workaround.