The Case of the Fake Picasso: Preventing History Forgery with Secure Provenance