@aljoscha another possibility, although it is a more complicated change than separately hashing the content, would a merkle tree hash of the entire chain, instead of just the previous message. Then it would be possible to prove that any two messages are in the same chain (that the later indirectly signs the former) without actually having all the intermediate messages. (dat supports this, but I felt it's interactions with indexes was too complicated, but not against introducing a new log format that supports this)