Gets the time the signer's certificate path was validated at: the time of Timestamp when that token is Valid and earlier than ValidationTime, otherwise that option (the time validation ran, by default).
public DateTimeOffset ValidationTime { get; }
ISO 32000-2 §12.8.3.4.5 b) ("the signature may be verified against a time other than the current time if ... a signature timestamp
is present"), §12.8.3.4.8; RFC 5280 §6.1.1 (b). The signature dictionary's M is not a trusted time and is not used.