It is so clear cut that the situation I described is illegal.

Sub-processors are not allowed to sign data processing agreements.

So not that clear it would seem ...