An append only logfile is easier, more reliable and more interoperable

Just require that each change is digitally signed with the doctor's key