Not that it's a panacea, but it could be signed with a private key to make it easy to validate whether it's a fake timecode or not. You could include crude, say

Not that it's a panacea, but it could be signed with a private key to make it easy to validate whether it's a fake timecode or not. You could include crude, say, cepstral coefficients in with the timecode as well to prevent the timecode from being copy pasted elsewhere.