The ESS signing-certificate or signing-certificate-v2 attribute does not identify the signer's certificate (§12.8.3.4.5 a): "if the hashes do not match, then the signature is considered invalid"; RFC 5035 §3, RFC 2634 §5.4). A time-stamp token without the attribute is reported too (RFC 3161 §2.4.1, RFC 5816 §2.2.1).
SigningCertificateMismatch = 9