Reject input documents with certification signatures and permissions=nochanges unless the "sacrifice" option has been supplied to avoid breaking existing certification signature.
No longer requires "conformance=extended" for NIST-15 elliptic curves other than P-256/P-384/P-521 since these are supposed to be supported in Acrobat.
Increased the default value of "timestampsize" to accommodate changes implemented in the configuration of a commonly used TSA.