HPDFVerifyHeadlessTimestampToken

procedure HPDFVerifyHeadlessTimestampToken(const SignatureValue, TokenDER: SysUtils.TBytes;
  const Options: THPDFHeadlessTimestampOptions);

Authenticates an existing RFC3161 token against SHA-256 of the actual CMS signature octets and explicit TSA trust roots, with critical timestamp EKU, ESS binding, and optional CRL verification

Offline token verification does not require the original request nonce; use HPDFVerifyHeadlessTimestampResponse when the original nonce-bearing request is available

Malformed tokens, trailing bytes, trust failures, and imprint mismatches raise EHPDFHeadlessTimestampError