Even though the activation address was reachable from the device, at some point it switches to the FQDN of the BES Server and uses that to complete activation. That internal FQDN was not able to resolved by the DNS server of the access point network.

I discovered this in the Wifi diagnostics screen. The hint that this was a problem was a cryptic DNSx error in the handheld log.