Hi Freek,
No, it is the later "... a subset of a topology from a given domain that consists of the resources and relations that have been changed/added/removed since a given timestamp?"
The idea was that we needed to verify topology because we may pull it from a third party server. To verify topology, we proposed "signing" the topology in full. The issue is that if you update part of the topology (e.g. add a new port), do you just submit the partial change and sign it, in which case, when you redistribute it, you'd have to keep the original topology file with the original signature distinct from the signed partial topology update. To simplify things, we said that when there is a change in the topology, the author must regenerate the whole topology again and sign it in it's entirety. In essence, a complete (domain) topology file is the atomic unit of information for the topology service.
Hope that helps.