FAQ
What we are asked most often
Short, sourced answers, without promising what does not exist yet. A question missing? Write to us.
Is OTSPI already a qualified trust service provider?
No. OTSPI is an initiative currently being formed as a non-profit association; no qualification has been applied for to date. A time-stamping service runs in a public test environment: the tokens it issues have no legal value. Qualification requires an audit by an accredited body and then a decision of the supervisory body, which alone may grant it. See the roadmap: no timetable is set until the institutions' opinions have been gathered.
There are already about 280 qualified providers: why one more?
Because the bottleneck is not their number but their access model: prior contract, per-unit pricing, proprietary interfaces, markets fragmented by country. At €0.03 to €0.15 excl. VAT per token, time-stamping 15,000 documents a month costs close to €10,000 excl. VAT a year. That shuts out SMEs, local authorities, universities and open source projects. OTSPI aims for the same level of qualification, with a free baseline service, identical for everyone and available through standard APIs. Details and sources in the white paper (§ 2).
Who funds the project?
The baseline is free; only enhanced commitments (volumes, availability, support) would involve a contribution. For the seed phase, the white paper targets digital commons support schemes, in-kind technology sponsorship and financial sponsorship. No funding is announced to date. The main expense items are listed in § 5.5; amounts will be established from quotes and then published.
What happens if the project is bought out or stops?
The draft statutes are designed to prevent it: unamendable purpose, conversion into a commercial company forbidden in perpetuity, inalienable assets and keys, a reserve fund for the termination plan and devolution to a similar body. These safeguards will only take effect once the statutes are adopted by the founding general meeting: they have not yet been voted. See the table of safeguards and the full draft (in French).
Is the baseline service really free and unlimited?
Free and without prior contract, yes; unlimited, no: public access is subject to a fair-use policy that caps rates, to protect the service. Needs for volume, guaranteed availability or support fall under enhanced commitments (white paper § 5.4).
Who decides, and how do you prevent one person from controlling everything?
The draft statutes strictly separate the executive management (the Board), the Trust Policy Committee and the Authority Officers, in line with ETSI EN 319 401. The root key is activated under quorum (3 cards out of 5). Today, the team is a single founder; the project is looking for the people who will hold the independent roles. Until the Committee is constituted, the draft statutes forbid any production release, production key ceremony and qualification application.
Is the code open? Can I audit it?
Yes. The whole stack is published under the European Union Public Licence (EUPL 1.2), compatible with AGPL v3, on GitHub. The engine is written in Rust. You can try the pilot with standard tools and comment on the white paper.
Will OTSPI issue TLS certificates?
It is a planned axis, not an available service. It requires two distinct roots (WebTrust for browsers, QWAC for the European trusted list), dedicated audits and inclusion in browser root programmes, whose decisions do not depend on OTSPI. It would only be started after the time-stamping service has been qualified. See § 2.4.
How does this compare with Let's Encrypt?
The method is comparable: free of charge, automated, transparent. The differences are fully acknowledged: a qualified provider is liable under Article 13 of the eIDAS Regulation, it is supervised by the national supervisory body, and its fixed audit, hosting and physical security costs are structurally higher. See § 2.6.
How can I get involved?
You can sign the manifesto, comment on the white paper, or write to contact@otspi.org if you are a hosting provider, funder, laboratory, auditor, software vendor or local authority (see the expected contributions). No membership is open to date: the statutes not having been voted, the association does not exist yet.