"So most likely the website is itself hashing the document, and then internally calling a service like described in the RFC to do the timestamping, and return the TimeStampReq (as well as the modified PDF)." . . . .