Thank god it's only 2 months old thread. I think I have found the bug on MxToolBox.
From section 3.7. Computing the Message Hashes of the RFC:
In hash step 2, the Signer/Verifier MUST pass the following to the
hash algorithm in the indicated order.
1. The header fields specified by...