Why use OP_RETURN for long-term timestamping if they are pruneable?

Question

There are some timestamping services such as proofofxistence.com that use OP_RETURNS transactions to store a document's hash, so in the future a 3rd party can verify the existence of the hash (and the document) at that particular time.

One of the assumptions of using the blockchain for trusted timestamping is that the data will be there for a long period of time. However, the OP_RETURN ouputs are unspendable (then pruneable). It can be theoretically forgotten by everybody without affecting the integrity of the blockchain.

Is it a good idea to use OP_RETURN transactions for long-term timestamping?

Answer 1

The point of timestamping is not data storage (that's a different use case). Timestamping is being able to prove that a particular piece of data existed before some point in time.

If you create a transaction that commits to a particular (hash of a) piece of data, you can always prove its presence in the blockchain by keeping the blockchain (including the block with your transaction) yourself.

In fact, that's not even necessary. Due to the fact that Bitcoin transactions are organized in a Merkle tree in blocks, you can just keep the transaction, and the hashes in the Merkle tree that connect your transaction hash to the Merkle root of that block. Anyone who has validated the chain (and thus has at least the block headers) can verify that implies your transaction was part of the chain.

Answer 2

However, the OP_RETURN outputs are unspendable (then pruneable). It can be theoretically forgotten by everybody without affecting the integrity of the blockchain.

It can be forgotten without affecting the integrity of the blockchain, but if a new node joins the network and wants to download the entire blockchain, there will be no way for existing nodes to prove that a missing transaction was OP_RETURN and therefore safe to forget. Therefore, someone (but not everyone) needs to keep the OP_RETURN transaction around.