Hi Tom,

well a timestamp only may be not enough, i would strongly
suggest at least to use the free GnuPG (in case you can't use
qualified signatures with .pdf's. to detach sign the the model
file(s) etc. with your secret key and then timestamp those
detached GnuPG signature files.

Regards
Stefan