Signing is always done with first key when label is supplied to pkcs11-tool

The pkcs11-tool from OpenSC does not support selecting the signing key by label. You need to specify the key id (CKA_ID), as this is unique. The label can be assigned to multiple objects.

If no id is specified, the first key is used.

The PKCS#11 interface does support selecting objects by filter. You can include CKA_LABEL in the search template to locate the object.