FROM <hash> fails with DOCKER_BUILDKIT=1 (but OK without)

This script builds the image with DOCKER_BUILDKIT=0, but not with DOCKER_BUILDKIT=1 (tested with Docker 19.03.1):

#!/bin/bash
set -eux
docker build --iidfile id - <<EOF
FROM alpine:3.10
RUN date > now
EOF
docker build - <<EOF
FROM $(cat id)
EOF

With old docker build:

$ env DOCKER_BUILDKIT=0 ./test.sh
+ docker build --iidfile id -
Sending build context to Docker daemon  2.048kB
Step 1/2 : FROM alpine:3.10
 ---> b7b28af77ffe
Step 2/2 : RUN date > now
 ---> Using cache
 ---> 650f26ff912d
Successfully built 650f26ff912d
+ docker build -
++ cat id
Sending build context to Docker daemon  2.048kB
Step 1/1 : FROM sha256:650f26ff912d359e3f38de9e8292c7e6ad30ddd5ff6809bc8229b70c86e65870
 ---> 650f26ff912d
Successfully built 650f26ff912d

With BuildKit:

$ env DOCKER_BUILDKIT=1 ./test.sh
+ docker build --iidfile id -
[+] Building 0.2s (6/6) FINISHED                                              
 => [internal] load build definition from Dockerfile                     0.1s
 => => transferring dockerfile: 75B                                      0.0s
 => [internal] load .dockerignore                                        0.1s
 => => transferring context: 2B                                          0.0s
 => [internal] load metadata for docker.io/library/alpine:3.10           0.0s
 => [1/2] FROM docker.io/library/alpine:3.10                             0.0s
 => CACHED [2/2] RUN date > now                                          0.0s
 => exporting to image                                                   0.0s
 => => exporting layers                                                  0.0s
 => => writing image sha256:f456d47bfddfc8936e6fd13c530d1f519146682a235  0.0s
+ docker build -
++ cat id
[+] Building 0.8s (4/4) FINISHED                                              
 => [internal] load build definition from Dockerfile                     0.1s
 => => transferring dockerfile: 120B                                     0.0s
 => [internal] load .dockerignore                                        0.2s
 => => transferring context: 2B                                          0.0s
 => ERROR [internal] load metadata for docker.io/library/sha256:f456d47  0.3s
 => ERROR [1/1] FROM docker.io/library/sha256:f456d47bfddfc8936e6fd13c5  0.3s
 => => resolve docker.io/library/sha256:f456d47bfddfc8936e6fd13c530d1f5  0.3s
------
 > [internal] load metadata for docker.io/library/sha256:f456d47bfddfc8936e6fd13c530d1f519146682a2353325468afdf8d9627dc60:
------
------
 > [1/1] FROM docker.io/library/sha256:f456d47bfddfc8936e6fd13c530d1f519146682a2353325468afdf8d9627dc60:
------
pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

Start by running the issue's test.sh reproduction with DOCKER_BUILDKIT=0 and DOCKER_BUILDKIT=1, comparing how the two docker build commands handle the digest from id. Trace the BuildKit path responsible for resolving the FROM value; done means the digest written by --iidfile can be consumed by a subsequent FROM under BuildKit without an attempted registry pull.