Include TSA Certificate in Timestamp Request
The behavior turned out to be a vulnerability. Details about it can be found here https://about.signpath.io/blog/2020/08/26/on-the-importance-of-trust-validation.html.