A method for storing tamper-evident data in one or more data structures, wherein the method comprises, under the control of each of a plurality of storage computing systems: storing (414,431,438,450), by the storage computing system, local one or more of the data structures each containing a persistent sequence of data blocks being associated with corresponding appending receipts, each of the appending receipts certifying a positive result of a verification by a certification computing system of an appending request for appending the data block to the corresponding data structure, the appending request comprising an indication of a new digest of a new version of the data structure with the data block appended thereto and a consistency proof for verifying without knowledge of the data block that the new version of the data structure contains a current version of the data structure with no alteration and that the new version of the data structure has been obtained by appending the data block to the current version of the data structure, distributing, by the storage computing system, one or more validation messages each comprising an indication of the succession of appending receipts of at least one of the local data structures to the other storage computing systems, receiving, by the storage computing system, one or more further validation messages each comprising an indication of the succession of appending receipts of at least one remote data structure of the data structures being distributed by the other storage computing systems, verifying, by the storage computing system, the certification computing system comprising verifying each of the further validation messages, said verifying each of the further validation messages comprising verifying the consistency proof of each of the appending receipts different from a first one along the corresponding succession of the further validation message, said verifying the consistency proof of the further validation message comprising verifying that the current digest of the remote data structure being calculated using the consistency proof of the further validation message matches the new digest indicated in a previous one of the appending receipts along the succession of the validation message and verifying that the new digest of the remote data structure indicated in the corresponding appending request matches the new digest of the remote data structure being calculated using the consistency proof of the validation message. storing (414,431,438,450), by the storage computing system, local one or more of the data structures each containing a persistent sequence of data blocks being associated with corresponding appending receipts, each of the appending receipts certifying a positive result of a verification by a certification computing system of an appending request for appending the data block to the corresponding data structure, the appending request comprising an indication of a new digest of a new version of the data structure with the data block appended thereto and a consistency proof for verifying without knowledge of the data block that the new version of the data structure contains a current version of the data structure with no alteration and that the new version of the data structure has been obtained by appending the data block to the current version of the data structure, distributing, by the storage computing system, one or more validation messages each comprising an indication of the succession of appending receipts of at least one of the local data structures to the other storage computing systems, receiving, by the storage computing system, one or more further validation messages each comprising an indication of the succession of appending receipts of at least one remote data structure of the data structures being distributed by the other storage computing systems, verifying, by the storage computing system, the certification computing system comprising verifying each of the further validation messages, said verifying each of the further validation messages comprising verifying the consistency proof of each of the appending receipts different from a first one along the corresponding succession of the further validation message, said verifying the consistency proof of the further validation message comprising verifying that the current digest of the remote data structure being calculated using the consistency proof of the further validation message matches the new digest indicated in a previous one of the appending receipts along the succession of the validation message and verifying that the new digest of the remote data structure indicated in the corresponding appending request matches the new digest of the remote data structure being calculated using the consistency proof of the validation message.