Yes, you can create a merkle tree which enforces a causal ordering, but anyone with the (potentially compromised) key can generate such a tree with whatever ord

Yes, you can create a merkle tree which enforces a causal ordering, but anyone with the (potentially compromised) key can generate such a tree with whatever ordering they want (or missing items). I concede, though, that the existence of multiple signed orderings would at least prove that the key had been compromised. You're also right that there is a huge cost to creating a secure blockchain from scratch, but the incremental cost of using an already secure public blockchain (such as Ethereum's) can be lower than the amount of value it brings to the table. Proving the existence of data, at specific timestamps in the past, when keys may have later been compromised, does seem like a use case that requires tamper-proof distributed consensus between untrusted parties. Whether that use case is particularly valuable or not is harder to judge, though, I admit.