Yes, it's likely that EntrySign and Papercut are using the same token/format (unless the readers used on Papercut are configured to manipulate the token) as EntrySign doesn't normally manipulate the token in any way (although it can if needed), so it really shouldn't be painful at all. Also, you mention that you import the token into AD - EntrySign also has the ability to pull tokens from an AD attribute and then push into Paxton if required so it can actually make things really easy.