"run java from the path the new java is installed"
This enabled the tool to run. The other thing that required some figgerin' out was that you first get asked for a password for your keystore - enter it, characters you type are echoed as you type them. Then it asks for a password for b4a. I didn't know this, so tried pasting in the code google gave and all sorts of things, but eventually figured out you type in the same password as for your keystore, but when you do the second password, the characters are not echoed. Just type it in and press enter.
After all of this I updated another app, and did more reading first and found out that if you do wot the mighty Erel says
HERE, then comile your app normally (not to aab), and upload the APK, then the key gets accepted and you don't need to mess about with the PEPK thing. Hope it stays that way.