Policy56 mOctober 17, 2026, 05:07

Nine free RFC 3161 endpoints checked against EU Trusted List: none is qualified

The author sent one timestamp request to each of nine public free RFC 3161 endpoints and matched the signing certificates against the EU Trusted List (LOTL sequence 397, issued 2026-10-15, 1,443 TSA/QTST entries). All nine responded and verified, but none is a qualified timestamp under eIDAS, even though five of the nine companies hold granted qualified entries.

DEV Community

Open source

Nine free RFC 3161 endpoints checked against EU Trusted List: none is qualified

Endpoints tested: FreeTSA, DigiCert, Sectigo, GlobalSign, Certum, SSL.com, Entrust, Apple, Actalis
Neither signing key nor issuer appears among the 1,443 qualified TSA/QTST entries
Five companies hold granted qualified entries, but not at their free URLs
Apple's signing certificate was issued 2026-10-15 and expires 2026-11-26 — 42 days

#DigiCert#Sectigo#GlobalSign#Apple

Post-quantum regulations converge on 2030 but split on scope

Policy

8 streaming services, 35 content complaints, 7 upheld; none checking reports

x402 Bazaar: 34,062 paid endpoints and 916,002 calls in 30 days

Security

Nine free RFC 3161 endpoints checked against EU Trusted List: none is qualified

Post-quantum regulations converge on 2030 but split on scope

8 streaming services, 35 content complaints, 7 upheld; none checking reports

x402 Bazaar: 34,062 paid endpoints and 916,002 calls in 30 days

Cloudflare applies to become a certificate authority for post-quantum certificates