Protecting clock from hacking
My recommendation would be to design a hardware module which repeatedly outputs the number of milliseconds (or microseconds, or seconds, or whatever) since it has been powered on, and the number of times it has been powered on.  If the device repeatedly outputs the time since startup and number of times it has been started, and doesn't accept any input from the Raspberry Pi, there would be no way for anything to tamper with the time since there would be no way for the Pi to do communicate with the device in any way.  An alternative would be to have the hardware module connect with some device separate from the Pi and allow the time to be set by that external device.  Cutting power to the device would disrupt time-keeping, but the next time the device is powered on its startup count would be changed.

If one wants to protect the device against physical tampering once it has been "started", one could use an external device to load a private signing key into RAM, and have the device sign all of its time reports.  If after the person who loads the private key has left someone else tries to alter the device, it would be impossible for someone who doesn't know the private key to alter the device without losing the private key.  Note, however, that such an approach would add security against setting the time forward but not against setting the time backward, since someone could capture the signed time data output by the device and build a fake device to replay that old data.  For security against physical tampering that would set time forward or backward, one would need to use a bidirectional communications path and have the device accept tokens, combine with time stamps, and sign them.