EU trusted lists

Opt-in. loadTrustLists() fetches the EU List of Trusted Lists (LOTL) and the national lists (ETSI TS 119 612), accepts a list only if its own XML signature verifies (the LOTL against pinned signer certificates, each national list against the certificates the LOTL publishes for it), and keeps the qualified CA/QC services with their certificates and dated status history. The result is a snapshot with its fetch date; trust/eu-trust-snapshot.json is one, refreshed weekly by a workflow that opens a pull request.

const euTrust = await loadTrustLists(); // or parseSnapshot(fileText)
const result = await convert(bytes, 'invoice.xml', undefined, { euTrust });
result.outcomes[0].invoices[0].source.signatures[0].euTrust;
// { qualified: true, status: 'qualified', service: { name, provider, territory, statusAtSigning, currentStatus }, snapshot: { fetchedAt, nextUpdate, stale } }

qualified means the signer chains to a CA/QC service whose status was granted at the signing time (a service withdrawn later still counts, one withdrawn before does not); snapshot.stale says the snapshot is older than its next-update date. trustAnchorsFromSnapshot(snapshot, at?) gives the service certificates as trustAnchors if you only want the chain check. The LOTL signer is pinned from lotlSigners, else from the previous snapshot, else trusted on first use (the snapshot says which, and the first update prints a note): pass the certificate from the Official Journal to pin it. Revocation of the signer’s own certificate (CRL/OCSP) is not checked.

In the browser page the check is a checkbox and loads lazily. The national servers mostly do not allow browser access (CORS), so the page falls back to the snapshot published with the site and says so.