Independent Instant Win timestamp verification (OpenSSL 3)

Download the locked prize map, timestamp request and FreeTSA receipt from the
verification page. Rename them map.txt, request.tsq and receipt.tsr.
Obtain the public CA certificate from https://freetsa.org/files/cacert.pem.
Cross-check its SHA-256 with https://freetsa.org/index_en.php:
2151b61137ffa86bf664691ba67e7da0b19f98c758e3d228d5d8ebf27e044438

Verify the request nonce and signed receipt:
openssl ts -verify -queryfile request.tsq -in receipt.tsr -CAfile cacert.pem

Independently check the EXACT downloaded prize map bytes against the receipt:
openssl ts -verify -data map.txt -in receipt.tsr -CAfile cacert.pem

Read the signed timestamp:
openssl ts -reply -in receipt.tsr -text

Compare with map.published_at in the evidence JSON, using UTC instants.
The server requires the signed time plus max(5 seconds, declared accuracy)
to precede publication. FreeTSA currently omits clock accuracy: five seconds
is an operational guard, not a certified bound. acceptance_time records that
guarded time. This is distinct from the original timestamp inside the receipt.

The map fingerprint includes competition ID, capacity, prizes and ticket numbers.
These checks attest existence of this map fingerprint at the signed time, not
when it was publicly available, how ticket allocation happened, or who owned a
ticket. Signature trust depends on FreeTSA's certificate and clock. Keep the
original files. Historical maps and local demos without receipts remain unstamped.