openssl tsa: invalid signer certificate purpose

I’m trying to create a TSA using openssl 3. I created a private CA (in “ca” dir), then keys and certs for the TSA (“tsa” dir).