If only prompts could also be watermarked.
The session data could be cryptographically signed. Probably easier in an open harness?