What you describe is pretty much exactly one of the schemes by which a fiscal authority might ensure non-modifyability. The fiscal authority would take up the part of the timestamping service in a real world implementation of course (no government ever would just let you freely choose a provider for such a service by yourself).

That is what I meant with “every implementation that shall not just be an elaborate security-by-obscurity scheme needs an authority”.

Note that no one will ever pay for anything like that if it is not mandated by some government under which you want to operate a significant number of POS installations. It is already crazy expensive to implement all these different and mind-numbingly clusterfucked schemes that all the countries with fiscal requirements want to have implemented. The one thing no one wants to do is coming up with just one more of these schemes that the countries in which no such thing is required will not care about anyway (lawyers will not be impressed at all by technical explanations why your records are super protected against manipulation - they will still call in the armies of accountants to run the numbers up and check your books).