I would also assume you could do a blockchain-type log -- ie the hash of an entry includes the hash of the previous entry so that if one entry is removed, the w

I would also assume you could do a blockchain-type log -- ie the hash of an entry includes the hash of the previous entry so that if one entry is removed, the whole thing is tamper-evident. Of course, then you need to ensure the integrity of the latest hash (if you can change one log, you can change them all). If the centralized logging server(s) are protected with the same rooted ssh, then it's just an additional step for our sophisticated state-sponsored boogeyman.