As you know, we use TLS for multiple purposes, including integrity, confidentiality and authentication and we use TSAs (Trusted Timestamp Authorities) to have signed timestamps for our data. (Read about it here)
The question is which one of the must be applied first?
In the other words, what is the data which we feed to TSA functions?
For first case the final packet which the final client receives is:
TLS_ENCRYPTED_DATA + TLS_ENCRYPTED_OF_TSA_SIGNATURE
For the second case, the final packet which the client receives is:
TLS_ENCRYPTED_DATA + TSA_SIGNATURE