Way 1 is obviously good, but what if you get a coolCoolCOOL highscore and server has crashed just before that and can't be transmitted, or you have made very high score offline and want others to know.

So i would make there "Update Online" button and open tcp socket to server app. Then transmit the full highscores with hash.

Forming the hash:
Every time the highscores are updated (NOT just before sending them), form a very complicated string out of the scores, maybe add some chars, change order, scramble and so on, then for example use MD5 to it. Server will form the same hash out of the scores and compare it, allows if valid. That's enough security imo