If revocation checking is disabled, then we should also allow the timestamp to be valid if the TSA certificate was valid when the timestamp was generated.

However, if revocation checking is enabled, we need to also check if the TSA certificate was not revoked. This requires adding revocation information to the signed JAR (CRLs or OCSP Responses) when it is signed (see 6890876).