That could possibly work but it would require the updates to happen only when the user is logged-in. Also trusting crypto that happened on the client has its own challenges, I think.