RFC 3161 Timestamping
- Token: DER-encoded TimeStampResp with embedded CMS TimeStampToken.
- Attach: `quantum-sign timestamp add --sig <FILE.qsig> --tsa <URL> [--policy-oid <OID>]`
- Verify: `quantum-sign timestamp verify --sig <FILE.qsig> --tsa-trust ./tsa-roots --json`
Trust
- Place TSA root/intermediate DERs in a directory (e.g., `./tsa-roots`).
- Current verifier checks status ∈ {accepted, grantedWithMods} and that the messageImprint
algorithm and digest match the `.qsig` digest. TSA chain/EKU validation is a follow‑up.
JSON fields
- `gen_time`: UNIX seconds
- `serial`: token serial (hex)
- `tsa_kid`: TSA key identifier (SHA‑256(SPKI) prefix)
Notes
- Sign and Verify remain offline and do not perform network access.
- Timestamping is an explicit step and re‑encodes `.qsig` canonically after update.