The Id attribute is set as the object_id, which is a number, but the
ID attribute is defined to be a NCName, which must start with either a letter or underscore (Regex \i)

I believe this can be fixed by changing the file wss4r/security/xml/timestamp.rb
from
  timestamp.add_attribute("wsu:Id", timestamp.object_id().to_s())
to
  timestamp.add_attribute("wsu:Id", "Timestamp-" + timestamp.object_id().to_s())

This is similar to how the ID field is generated for the UsernameToken