When re-scanning after a scanner upgrade, appending a new attestation with the scanner version and timestamp recorded is more reasonable than an overwrite-style update and facilitates audit traceability.