The grandpa.proveFinality rpc provides the justification for the last block by a GRANDPA authorities set (of some set_id) and ancestry headers to prove the finality of a block within the same set_id. But it does not seem to include any indication in the provided finality_proof that the GRANDPA authorities have changed.
So an adversary that has corrupted a(n old) GRANDPA authorities set can forever fool an external observer that the GRANDPA authorities have not changed and the finality proofs being provided by the adversary is infact valid, if the external observer does not have access to the chain's storage (and continuously checks it)?
The only way I can think of solving this is that we can check every single header for
ConsensusLog::ForcedChange digest logs.
ConsensusLog::ScheduledChange seems to apply the new set immediately in the same block the digest is emitted, and in the case of
ConsensusLog::ForcedChange it applies the new set after
delay number of blocks after the block in which the digest is emitted.
Is this a reliable way to approach this? Is this how it is intended?