TSA (Timestamp Authority)

A TSA (Timestamp Authority) is an accredited trusted third party that issues timestamp tokens compliant with RFC 3161 (Internet X.509 PKI Time-Stamp Protocol). The process: the client calculates the fingerprint (hash) of the document and sends it to the TSA via HTTPS; the TSA cryptographically signs a token containing this hash + the certified UTC reception time. This token proves that the document existed in that exact state on that specific date, without the TSA ever having access to the document itself. A qualified TSA (QTSA) listed on the EU trust list produces a qualified eIDAS timestamp, the most evidential form. In PAdES-LT and PAdES-LTA, TSA tokens are embedded in the PDF, ensuring offline verifiability in 20 years even if the original TSA has disappeared.