> you could reasonably expect to create a confusing enough (though not identical) NFT with an earlier timestamp
The timestamp is the block-chain, not what's written on the document.
> Yes, but as a buyer, how do I know the difference?
As it stands, you'd have to know who you were buying from fairly well. Just as you would with a physical art piece (which could be also be a fraud).
Personally, I'd make sure that the image being hashed was also hosted somewhere only accessible through official means.
For instance, I'd have the louvre host the image denoting the NFT as ownership on their official website, then tweet them to make sure they weren't just hacked, and wait a few days to confirm.
But all of these issues are more related to what NFT's are now, vs what they may become. There are definitely ways of solving these issues.
Though I still don't see why any non-official NFT would ever be of any value.