Information on a U.S. death certificate is usually reported to the funeral director by a close relative, though it could be a nursing home, if the person had no close relatives. The birth information is not verified by another source, so it is relying on the person who reports it, and they may only know an approximate age.
The person who reported the birth information for the death certificate is likely to be the same person who ordered the headstone, so I usually do not consider these to be two independent sources of information. Same for the obituary (if there is one), because the source, agaain, is likely to be the same person.
It is likely that the person provided his own birth date on the draft registration card. He would be likely to know his own date of birth. However, there is the possibility tat he exaggerated his year of birth to qualify for the draft - I've seen that for a couple of my relatives.
The date of birth on the Social Security Death Index is likely to be the most accurate. The date of birth is not reported to the Social Security Administration after the person's death - it comes from information provided when the person applied for his Social Security card. In the case of your great grandfather, that was likely in 1936, when the cards were first issued. I can't vouch for the verification of the data in those early years, but I know that since at least the 1960s, the Social Security Administration required an adult to present a U.S. birth certificate or a U.S. passport, or some equally strong source or sources. However, the SSDI is an index, so it is a secondary source. If you are looking for better proof, since you have the the Social Security number, I would send a request to the the Social Security Administration to get a copy of his application for a the Social Security number (SS-5 form), which will definitely give you the most accurate date. As a bonus, it will give you his address at that time, place of birth, names of parents, and his signature.