PAdES

PAdES is the ETSI profile for PDF signatures, and its four baseline levels stack. B-B is the signature itself. B-T adds a timestamp from a timestamp authority, so the signing time no longer rests on the signer’s clock. B-LT adds the certificates and revocation data a validator needs. B-LTA adds a document timestamp over all of it so the validation data stays protected after the algorithms age.

Pick the lowest level that covers how long the document has to stay verifiable. PAdES B-B has a table for that. Validating PAdES signatures is in Validation. To control how a B-T or B-LT signature reaches the timestamp authority, see custom timestamp client.

The examples are in signatures/pades.