Rewriting the entire blockchain: is it possible to spoof block timestamps of a privately mined chain?
Yes, an attacker could spoof the timestamps on the block and create a covert alternative history. However, this doesn't make much of a difference in this attack. The reason is that, if the attacker chooses to manipulate timestamps to increase the difficulty, then they will end up producing fewer, in count, high-difficulty blocks. On the other hand, if they choose to manipulate timestamps to lower the difficulty, then they will end up producing more, in count, low-difficulty blocks. In any case, the cumulative difficulty in the adversarial chain will be the same (both in expectation and, due to a Chernoff bound, with high probability, unless they increase difficulty tremendously).

I'm doubtful about your claim that the network will realize there's a problem. The attacker's chain will remain private until they have surpassed the current honest chain in cumulative difficulty. During covert mining, the honest parties are unaware that an attack is taking place (and the honest chain can continue growing, provided there is some non-majority honest power). The attack will only become visible when the attacker reveals the chain, when the honest parties will instantly switch to it. At that point, the attacker can perform a large double spending attack and walk away prior to the honest parties employing a patch.

One thing the attacker has to keep in mind is that the current blockchain is sometimes checkpointed, so if a client has a checkpoint, then the adversary can only reorg the chain up to that checkpoint. Furthermore, especially near the present, the block timestamps have to match the current time of the verifier computers, as this is checked by some clients, at least approximately. Other than that, this attack could work.