Threat model is a good question. For the sake of the challenge let’s say we don’t trust the person (or people) creating the document. Let’s also assume they ha

Threat model is a good question. For the sake of the challenge let’s say we don’t trust the person (or people) creating the document. Let’s also assume they have a vested interest in proving that a thing happened when it did not. In the case of the scenario above: The person in charge of the records is a traitor and if they can “prove” that the meeting took place on a specific day the president will be impeached. What we do trust is the servers that are used when a document is submitted, but all we can be sure of is the time of the submission (and the fact that it’s signed by the document creator, but we don’t trust them) Since the document creator could be offline for an extended period for non-suspicious reasons, we can’t use submission date as creation date.