--- title: C2PA only works if everything is signed | daily.dev description: C2PA Content Credentials use PKI-based digital signatures to embed unforgeable authorship metadata in image files, distinguishing AI-generated from... canonical: https://daily.dev/posts/c2pa-only-works-if-everything-is-signed-mrgmzs3k9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: C2PA only works if everything is signed | daily.dev og:description: C2PA Content Credentials use PKI-based digital signatures to embed unforgeable authorship metadata in image files, distinguishing AI-generated from... og:url: https://daily.dev/posts/c2pa-only-works-if-everything-is-signed-mrgmzs3k9 og:image: https://api.daily.dev/og/posts/MRGMZs3K9.png og:image:alt: C2PA only works if everything is signed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # C2PA only works if everything is signed **[sean goedecke](https://daily.dev/sources/seangoedecke)** · 11 min read · 2 upvotes · 0 comments ## Summary C2PA Content Credentials use PKI-based digital signatures to embed unforgeable authorship metadata in image files, distinguishing AI-generated from human-created content. However, the system is currently near-useless: only a handful of images in the wild are signed, almost all of them AI-generated, while human-captured photos (including iPhones) go unsigned. For C2PA to work, every camera manufacturer must sign photos by default and every social media platform must preserve the metadata rather than stripping it during re-encoding — both requiring significant regulation and engineering effort. Physical attacks on cameras can still spoof signatures, and key management for offline tools remains unsolved. The EU AI Act's current mandate only covers AI-generated content, which is insufficient; without universal signing, removing a C2PA tag is trivially easy. In the long run, once adoption is universal, C2PA could meaningfully stem AI content fraud, but in the near term it functions mainly as safety theater for companies under regulatory pressure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Google Pixel 10 Adds C2PA Support to Verify AI-Generated Media Authenticity](https://daily.dev/posts/google-pixel-10-adds-c2pa-support-to-verify-ai-generated-media-authenticity-gfzbiyf56) · The Hacker News · 0 upvotes · 0 comments - [C2PA Cameras Do Not Survive Contact With Reality](https://daily.dev/posts/c2pa-cameras-do-not-survive-contact-with-reality-ihlzsaqlv) · Lobsters · 0 upvotes · 0 comments --- Tags: [#ai-regulation](https://daily.dev/tags/ai-regulation) [View this post on daily.dev](https://daily.dev/posts/c2pa-only-works-if-everything-is-signed-mrgmzs3k9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"C2PA only works if everything is signed","url":"https://daily.dev/posts/c2pa-only-works-if-everything-is-signed-mrgmzs3k9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/c2pa-only-works-if-everything-is-signed-mrgmzs3k9"},"datePublished":"2026-07-06T04:07:17.134Z","dateModified":"2026-07-06T06:21:13.184Z","description":"C2PA Content Credentials use PKI-based digital signatures to embed unforgeable authorship metadata in image files, distinguishing AI-generated from...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/479e95ee2af112c350fa09a341f0c630?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/479e95ee2af112c350fa09a341f0c630?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"sean goedecke","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"sean goedecke","logo":"https://media.daily.dev/image/upload/s--WNgiZyDx--/f_auto,q_auto/v1765713419/logos/seangoedecke","url":"https://daily.dev/sources/seangoedecke"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/c2pa-only-works-if-everything-is-signed-mrgmzs3k9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-regulation","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"sean goedecke","item":"https://daily.dev/sources/seangoedecke"},{"@type":"ListItem","position":3,"name":"C2PA only works if everything is signed"}]} ```