Thanks for thinking this though and writing it down. There also still no proof of no tampering unless the agent is external and publishes right away. So maybe y

Thanks for thinking this though and writing it down. There also still no proof of no tampering unless the agent is external and publishes right away. So maybe you could have a service that generates these, but then again, the service could just sign the logs.