Trust nothing.
Verify everything.

Every new record carries a device-held identity authorization, a Tessellith Proof Authority countersignature and a link to the state before it. Any altered byte breaks verification.