I think that there is a problem with generating "X-WOPI-Proof" header. It works fine only for the 1st request. Then, it keeps returning the same value each time. I managed to solve it by tweaking the SignProof method (wsd/ProofKey.cpp):

std::string Proof::SignProof(const std::vectorchar>& proof) const
{
    assert(m_pKey);
    static Poco::Crypto::RSADigestEngine digestEngine(*m_pKey, "SHA256");
    digestEngine.reset(); #this line fixed the issue
    digestEngine.update(proof.data(), proof.size()); 
    return BytesToBase64(digestEngine.signature());
} 

I'm unsure if fully understand wopi proof key docs, so instead of creating a merge request, I submit this bug.