Right, the GPG timestamp is trivial to fake. There is also RFC 3151 timestamp protocol, but it uses a trusted third party rather than distributed trust.