How to add timestamping signature to System.IO.Packaging.Package?

Question

There is a way to create packages, add some parts and sign it with a X509Certificate.

I would also like to add a timestamping signature to the package.

If the certificate expires or gets revoked the signature should remain valid if the package parts have been timestamped before the expiration/revokation.

P.S. I'm using the System.IO.Packaging.Package class defined in the WindowsBase.dll assembly.

Answer 1

The following solution works it you're both the creator and the consumer of the package:

1. Use a secure Internet server to get the trusted timestamp.
2. Redefine the certificate chain policy to include the timestamp validation in the certificate chain.