Based on the given situation, the museum won't own the caller's cell phone number that they're trying to legitimately spoof for their staff's cell phone.
Asterisk is an open-source PBX system.
I think the original call will come in with the correct STIR/SHAKEN-validated SIP headers and the PBX can forward them as is, see some discussion here: https://community.freepbx.org/t/stop-robocalls-act/60921/5
I previously worked at a telecom software company, and I know everyone with their shit together has been preparing for this for a long time, which is why I'm not concerned that these common cases should continue working. These softwares are often built on top of or on a branch of Freeswitch/Asterisk.