code: private void verifyTimestamp(TimestampToken token, byte[] signature)
          throws NoSuchAlgorithmException, SignatureException {
  
          MessageDigest md =
              MessageDigest.getInstance(token.getHashAlgorithm().getName());
  
          if (!Arrays.equals(token.getHashedMessage(), md.digest(signature))) {
              throw new SignatureException("Signature timestamp (#" +
                  token.getSerialNumber() + ") generated on " + token.getDate() +
                  " is inapplicable");
          }
  
          if (debug != null) {
              debug.println();
              debug.println("Detected signature timestamp (#" +
                  token.getSerialNumber() + ") generated on " + token.getDate());
              debug.println();
          }
      }
docs: /*
  Check that the signature timestamp applies to this signature.
  Match the hash present in the signature timestamp token against the hash
  of this signature.