It doesn’t have to be a random person claiming that the first image is fake.
Then we’re no longer talking about an “evil maid” attack. I’m not going to engage in further goalpost-shifting, you’re just adding and removing from the scenario arbitrarily and demanding that this system must satisfy every constraint you throw at it.
If you don’t want to use this system, fine, don’t use it. It’s not for you.
There’s no goalpost-shifting, the evil maid is still getting your keys. I’m not sure what you’re not getting here.
The point is that the system is useful for exactly nobody, because you still have to trust that someone hasn’t had their private keys compromised via an evil maid attack, and publishing timestamps on a blockchain is irrelevant to the problem.
