You can do it on a single machine if you use the TPM to create log hashes which can't be rolled back.