[jamesmccann]

You can sign records in a normal database. Implement some segregation of duty and don't give your DB admins access to any signing keys.

[__MatrixMan__]

They can still delete records, restore from backups, etc