I've asked the OP to create a GitHub issue for this as I don't plan to work this myself. Adding for tracking.
The Asterisk implementation requires a Date header, but it should not.
There was an issue with the standards early on that the IETF defined something called a "compact" form of the PASSporT, where only the signature was sent and all the other parameters were reconstructed from the SIP headers. So in that case there would be no "iat" and the date would come from Date. "shaken" and all the ATIS-defined PASSporTs only use full-form where all the info is in the JSON header/payload. Some people still insist on sending date but the recommendation is not to trust it and not to look at it to determine the date the PASSporT was generated.
You must be