From what I understand systemd can optionally store a copy of the logs on a remote server. The key to modify the logs on the remote server is changed in such a way that even if a system is compromised the log copy on the remote system can not be changed.

These remote copies of the logs could actually be used to detect log-tampering and 0day exploits.