Embed PAdES long-term validation (LTV) data — OCSP/CRL revocation info and a trusted timestamp — into a PDF signature using the EU's open-source DSS (Digital Signature Service) library

Steps

1. Use the European Commission's open-source DSS library, instantiating a PAdESService configured with a CertificateVerifier that has OCSP and CRL sources so it can fetch revocation data for every certificate in the signing chain.
2. Sign at a baseline level that already embeds a trusted timestamp — target PAdES baseline-T (or go straight to baseline-LT) so an RFC 3161 timestamp token from a configured TSP source is included with the signature.
3. Extend the signature to PAdES baseline-LT via the service's document-extension call: this fetches and embeds the full certificate chain plus the matching OCSP responses/CRLs for every certificate (signer, TSA, and issuers) into the PDF's Document Security Store dictionary as validation-related information, per ETSI EN 319 142.
4. For archival durability beyond the validity window of the LT-level material, extend further to PAdES baseline-LTA, which adds a second, document-level timestamp covering the whole PDF including the already-embedded revocation data.
5. Validate the result with DSS's own validation tooling to confirm the signature reports as LT (or LTA) with all revocation/certificate-chain data resolvable offline directly from the PDF.