If current time (now) is equal to if h1.Header.bfttime + tp - epsilon, where epsilon is very small value, then the if h1.Header.bfttime + tp > now so the first check of CheckSupport is true, but while we execute other checks (signature verification), trusted period of h1 expires. So it can happen that CheckSupport returns true and we trust h2 although validators from h1 are not anymore accountable. With carefully mounted attack faulty validators from h1 can craft h2 in whatever way they want and they will not be accountable for this attack.