> I don't know if there's an accepted strategy, but if I had to create one
> from scratch, off the top of my head I'm thinking some time of time
> server. It would have to publish a signed file of the current time, say
> once per minute, so that you could include the hash in the above noted
> tarball. The recipient could note the time of that hash file, query the
> time server for the matching hash and compare the two. If they match,
> then the time matches.
Slightly OT...
That (and variations therof) would work for a 'not earlier than' lower
bound, but I'm pretty sure there is a good theoretical reason why 'not
later than' shouldn't be possible without a third party, making
timestamping (in the sense of having happened in this given interval)
impossible. I am open to contradiction though :)
--
steev
http://www.daikaiju.org.uk/~steve/