I doubt that you will find any commercial CAs offering certificates using timestamping. There is no market, and this is contrary to their interests. Just like a certificate using CA or OSCPSigning, you can only get it if you have some kind of business deal with CA.
If you offer a TSP service, you can simply use a regular certificate and ignore the use. Depending on the library used, it cannot check usage at all. However, Java 6 checks it out.
You can also use a self-signed certificate and distribute your root certificate authority to those who want to perform a local verification.
source
share