HPDFVerifyHeadlessTimestampResponseForImprint

function HPDFVerifyHeadlessTimestampResponseForImprint(const MessageImprint, RequestDER,
  ResponseDER: SysUtils.TBytes; Digest: THPDFHeadlessTimestampDigest;
  const Options: THPDFHeadlessTimestampOptions): SysUtils.TBytes;

Authenticates a complete DER TimeStampResp against its original nonce-bearing request and the exact digest bytes supplied, then returns the validated DER CMS TimeStampToken

Verification requires explicit trusted CA roots and checks the actual digest OID, imprint, request nonce, response status, CMS signature, TSA certificate binding, certificate chain and critical timestamp EKU

Configured revocation checking additionally requires issuer-authenticated CRL evidence; malformed or trailing DER, another nonce, another imprint, unknown trust, revoked or expired certificates, expired CRLs, response budgets and cancellation all fail validation

See Native RFC3161 timestamps for transport and trust configuration