The x tag contains the file hash, you don't need the time attestation to spot a remote update.