Brainstorming: Adopting and finding use case of external Timestamp Authority (TSA) in Dex

[Dentrax]

A timestamping authority (TSA) like the one defined in the RFC-3161 protocol works as a trusted third-party providing a "proof-of-existence" that the data existed at a particular moment in time. ¹

TSA servers must sign each timestamp message using a public key infrastructure reserved specifically for that purpose. Once the client receives the signed response it uses the TSA server’s root public key to verify the signature. The client verifies that the timestamp response comes from the expected party, covers the provided data and has an up-to-date time.

I'm curious if there is any use-case to implement TSA² client in Dex to verify signed timestamps. I've surfed the source code a bit and notice Dex mostly rely on time.Now for generating oidc, oauth2 tokens. For example, verifying expirations of the certificates that were created at a certain time.

• Ref: A TSA server implementation called timestamp-authority from project sigstore.

Footnotes

1. https://www.chainguard.dev/unchained/how-to-sign-private-artifacts-securely ↩

2. https://datatracker.ietf.org/doc/html/rfc3161 ↩