What a timestamp proves

A document records content. A backup records data. Neither, on its own, proves to a third party when it came into existence — the content and the data could have been produced at any point before someone chose to show them to you. An RFC 3161 timestamp token addresses that specific gap: it's an independent third party's attestation that a given hash existed at a given time.

A token attests to exactly that — that the exact byte sequence behind a given hash existed at the time named in the token — and nothing more. It doesn't attest to authorship, to the legality of the content, or to whether the content is correct. Combined with a digital signature over the same data, a timestamp establishes when the signature was made, which is what makes it useful for evidence that has to hold up independent of whether a signing key is later compromised or revoked.

Why verification doesn't require contacting CNX

Every token embeds its own signing chain — the signer certificate, the TSA intermediate, and the root CA — rather than requiring a relying party to look up the signer separately. Verification is a self-contained cryptographic check against that chain plus the original data, and stays valid even if CNX is unreachable at verification time. See Verifying a timestamp for the actual procedure, and The trust anchor for how the root CA itself is pinned independent of any single token.