HPDFVerifyHeadlessTimestampResponseForImprint

function HPDFVerifyHeadlessTimestampResponseForImprint(const MessageImprint, RequestDER,
  ResponseDER: SysUtils.TBytes; Digest: THPDFHeadlessTimestampDigest;
  const Options: THPDFHeadlessTimestampOptions): SysUtils.TBytes;

Authenticates a complete DER TimeStampResp against its original nonce-bearing request and the exact supplied digest bytes, then returns the validated DER CMS TimeStampToken

Verification requires explicit trusted CA roots and checks the actual digest OID, imprint, request nonce, response status, CMS signature, TSA certificate binding, certificate chain, and critical timestamp EKU

Configured revocation checking also requires issuer-authenticated CRL evidence; malformed or trailing DER, another nonce, another imprint, unknown trust, revoked or expired certificates, expired CRLs, response budgets, and cancellation fail validation

See Native RFC3161 timestamps for transport and trust configuration