BTW I think that for real verification I should not get the certificates from the token files themselves (because they can be fake/self signed?) if the files were from an untrusted party.
The concept of PKI is that you can accept subordinate certificates, possibly to multiple levels, from an untrusted source or via an untrusted channel, and (...
You can get embedded certificates in you timestamp token with the command :
openssl pkcs7 -inform der -in token.tst -print_certs | sed -n '/-----BEGIN/,/-----END/p' > chain.pem
Or if you deals with TSR (timestamp response) instead of TST (timestamp token) :
openssl ts -reply -in timestampresponse.tsr -token_out | openssl pkcs7 -inform der -print_certs |...