Why not use RFC 3161?

Due to how the code signing works, timestamping servers are provided by all major CAs with full public access, e.g. timestamp.digicert.com, timestamp.comodoca.com, timestamp.sectigo.com, etc.

PS. OP, your comments are auto-killed for some reason. You may want to message mods to get this sorted.