Doesn't this mean that a 3rd party tracking cookie is now a cryptographic proof that device A traversed sites X Y Z in session N?