You must log all application data changes and be able to verify log authenticity. How should logging be designed?

Digitally signing each timestamped log entry and storing the signature ensures log authenticity and immutability. The digital signature acts as a tamper-evident seal; any modification to the log entry invalidates the signature, making unauthorized changes detectable. Timestamping provides an auditable record of when the event occurred. Writing logs concurrently to cloud and on-premises storage provides redundancy but doesn't guarantee authenticity. Storing logs in a SQL database with restricted access helps with access control but doesn't prevent an authorized but malicious actor from altering logs without detection. Serializing logs to JSON and storing them in Cloud Storage is a storage format and location, not a method for verifying authenticity.