Messages in river are sorted by timestamp using a (non-cryptographic) hash of the message signature as tie-breaker, essentially a content hash.

One weakness is that we trust the message author to provide an accurate message timestamp, however bad behavior such as manipulating timestamps can be addressed by banning the user from the room.