evcli cca create -p iak_priv.jwk -r rak_priv.jwk -c claims.json -t token.cbor does not overwrite the cca-realm-public-key claim to match rak_pub. It instead signs the claims present in claims.json, resulting in an invalid output token (unless the realm public key claim is updated in the json before running the command).