What if I write a browser extension that lets me upload a file from my computer with an arbitrary timestamp when I'm prompted to take a photograph? That seems like the obvious attack.