Especially complicated if you want the "LTV" thing to show up in Acrobat. As far as I could determine (I've done it and acrobat is happy), it requires fetching

Especially complicated if you want the "LTV" thing to show up in Acrobat. As far as I could determine (I've done it and acrobat is happy), it requires fetching and embedding the necessary CRLs for the TSA (timestamp authority) cert chain before getting the signature, but you don't have the certs with the CRL urls until after you get the signature. And the URLs can change over time (our TSA just switched its cert chain, but they did notify us ahead of time).