If someone asks you to prove it, can you produce the exact bytes you timestamped?
Here's the question worth asking about any release you've hashed, signed or timestamped: if someone challenged it, could you hand them the exact bytes that went into the hash? I don't mean "the same release" or "the same source at the same commit". I mean the same bytes. A hash doesn't care what the file means. It only checks bytes. And a proof that some hash existed at some point is worth nothing if you can't produce a file that hashes to it. So it's worth working through properly. The obvious…