> > For SSB, the aim was to be able to gossip feeds via untrusted intermediaries, with patchy network connections all round, and be sure that the intermediaries haven't added, changed or removed any posts in the feed.

> why would that need a blockchain (even without proof of work), as opposed to simple signed, timestamped, indexed posts and having the reading client app check the signature and post indices?

It depends on how the message is signed. If the message format's this:

sign_message(message + timestamp + index) + message + timestamp + index

The 'index' can be manipulated: The signer (malicious or not) can resign an old message & effectively overwrite a previous message.

sign_message(new_message + old_timestamp + old_index) + new_message + old_timestamp + old_index

This means that in the event of such a resigning, it's the app's responsibility to prevent resigned messages from overwriting old messages.

Blockchains prevent this at the data structure level because signature hashes are effectively random, meaning they're near-impossible to tamper with:

whole_message := prev_message_hash + sign_message(message + timestamp) + message + timestamp

wherein prev_message_hash := hash(prev_whole_message)