Something I was thinking of, what if you have two hosts, which don't trust each other in any way, set them up to use a network filesystem of sorts and run tripwire on the "other" host. So for host A, tripwire would run on host B and for host B, tripwire would run on host A. A better way, if your hardware permits, is to use dual-ported disks.