Separate S3 access keys for backups and uploads?

Yup. Backblaze handling of application key permissions seems to be (drastically) simpler than AWS.

A Backblaze permission key seems to have access to either a single bucket or all buckets in the owners account.

So the discourse S3 interface is just fine for AWS S3 buckets, but not quite as good for Backblaze B2 buckets.