If only prompts could also be watermarked.

The session data could be cryptographically signed. Probably easier in an open harness?