All exchanges should have synced clocks and all messages should have a timestamp up to 2 seconds in the future when they will be published by each exchange. The buffering would be internal to each exchange and not shared with anybody. You can only cancel after what you are cancelling is published. This would allow everyone to make all exchanges publish at once so people with fast cable between exchanges can't beat out those that don't.
