> jam the same stream.

To add to that, other people won't be able to spoof the original stream (as that needs the private key), but instead only jam it.

It would be the same failure mode as SSL certificates.

In the case of gnss systems, you can also spoof the stream, since the interesting bit of the stream is not the data contained inside, but instead the relative time of arrival of different streams from different satellites.

An attacker can record the streams and replay them milliseconds later.

A client can protect against this if they have an atomic clock, but that's only for clients willing to pay a decent amount.