Is there a hardware counter/hash/timestamp of last successfully firmware updating or restoring to factory mode? This identify information should not be changed directly by any normal firmware functions, and always be different to all the existing ones.
No there is not a timestamp stored on the OnlyKey of the last time a factory default or firmware update was completed. OnlyKey is a device without a battery, as such any concept of time or timestamps would come from another connected device that has a clock.
what about a counter or a verify signature flash on to the chip?
counter: increase by 1 each time updating firmware or restoring to factory mode
signature: sign(hash(old-signature) || new action context)
OnlyKey only loads firmware signed by CryptoTrust. Also the firmware integrity is verified each time OnlyKey is powered on, there is more information on firmware verification here - About Security | Docs