So the origination ID would be the SHAKEN service point and carrier that first authenticates the call?

That is correct - the first SIP service provider to handle the call will apply the identity token and assign the origin-id.