Péter Szilágyi, in his talk in Taipei, claims that totalDifficulty can be spoofed:
https://www.youtube.com/watch?time_continue=575&v=qJA6J0mP73w
How is that possible? Can the variable only be verified if all block headers are downloaded from the spoofed chain and would that produce a fraud proof?