The Bug That Proved My Own Point: A Post-Mortem on TSA Verification
rust
dev.to
In my previous post, I argued that Git history is not enough as proof because timestamps and commit data can easily be rewritten. The core thesis was simple: you cannot rely on a verification model controlled by a single interested party; you need an independent, external source of truth, such as an RFC 3161 Time Stamping Authority (TSA). Then, I broke our own verification pipeline. This is a technical post-mortem on how a subtle bug in our verification path nearly turned a valid cryptographic