Perhaps if those logs were streamed to a non-compromised machine and stored there
And how do we know the logs that are emitted are trustworthy?