This makes it sound like they also offer the service of signing calls for you, although I’m not sure since I don’t use Bandwidth. That being said, @BlazeStudios is correct in saying that you are required to be doing all of these things in order to sign the calls with your own cert:
1.) Get an FRN and file in the Robocall Mitigation Database
2.) File your 499
3.) Get an OCN
4.) Get your STIR/SHAKEN token
5.) Get your certificate
All of those steps must be completed by 6/20 according to the FCC