with https://www.openssl.org/docs/man1.1.0/man1/openssl-ts.html openssl ts -verify option I can verify tokens that were previously requested using openssl ts -request
For me this verification only works if the timestamp token that I verify was requested with the -cert argument (ie if it embedds the signing certificate and its trust chain).
How can I verify a token that does not embedd the signing certificate and trustchain (ie if it was requested without the -cert argument)?
Also: what exactly does OpenSSL verify? for example, does it check for all certificates in the trust-chain whether they have been revoked and if so for what reason? (which would need to be done according to RFC3161 spec)