Hi,
>> I would not make signing mandatory in cases when the time was not obtained from a trusted source.
>> That is, the time was not supplied by a "Time-Stamping-Authority". This excludes case 1. As for XadES,
>> I would require validation data for the time stamp.
>
> This was also attempting to standardize the existing implementation. It is fine with me if the signing time
> is not mandatory, but I know I have places in my code where I emit some element, and then have an
> improper assumption that others emit it as well. If we all agree to put the same elements, then it helps
> interoperability. However, IIRC, the untrusted signing time is a required XAdES element for the lowest
> levels of XAdES. The timestamp time could well be days or even weeks later. I think it is fine to have an
> untrusted signing time as long as you treat it as untrusted.
From the XAdES spec:
"A XAdES-BES signature MAY also contain the following properties:
- the SigningTime signed property
...
So it is untrusted, not mandatory, but IMHO it is still useful...
Bart
