[vanbroup]

An untrusted, backdated RFC 3161 token could make an expired signing certificate validate and turn later revocation into a warning. Separately, a crafted PDF /ByteRange could reach an unchecked allocation and panic the fluent verification API before cryptographic signature verification.

This change closes both paths:

• Establish TSA trust before adopting timestamp time. Untrusted or unchecked timestamps remain available as metadata and warnings, while certificate validation uses the existing caller-time/signature-time/current-time fallback policy. Revocation timing independently requires TimestampTrusted, rather than relying on the time-source label. Configured roots and explicit embedded/self-signed trust remain supported.
• Enable TSA certificate validation by default in the fluent builder, matching the documented default, while preserving explicit opt-out without granting historical-time trust.
• Share checked byte-range parsing between revision selection, detached signatures, and document timestamps. Reject invalid array shapes, non-integer values, negatives, out-of-file or overflowing ranges, and overlapping ranges before reading or allocating. Keep ordered multi-pair ranges supported and bound total content size by the actual file size and platform allocation limit.
• Convert unexpected verification panics into an error and discard partial results so repeated access cannot report success after recovery.

Validation:

• Reproduced the timestamp expiry/revocation bypass through both public APIs against unpatched rc4; legitimate trusted and explicitly accepted self-signed TSA controls pass.
• Reproduced negative-length allocation panics in both detached and document-timestamp paths against an isolated rc4 baseline.
• Added public-API regressions for expiry, revocation, default/disabled TSA validation, malformed byte ranges, and repeated access after panic recovery. Direct helper tests establish that malformed ranges fail before any read and that valid multi-pair ranges still work; fallback and exported signer-state checks cover untrusted timestamp handling independently.
• go test -race ./... passes locally.
• golangci-lint run ./... reports 0 issues; formatting and diff checks pass.
• Independent read-only candidate review reported no bypass or regression findings.

The repository CI runs external pdfcpu/DSS validation and the downloaded corpus checks; these were not rerun locally. This PR does not mark either follow-up issue as fixed in a released version.