One bug revoked every photo those cameras signed

TL;DR. Content Credentials became ISO/IEC 22144 in 2025, the coalition passed 6,000 members, and signing now ships by default on consumer hardware: Google Pixel 10 signs every photo using hardware-backed keys and an on-device timestamping authority. Then Nikon added signing to the Z6 III, found a critical vulnerability in it, and revoked all issued certificates, invalidating every credential those cameras had produced. As of early 2026 the service has not been restored. The deeper problem is that signing outpaces verification. Social platforms strip embedded metadata during upload and transcoding, certificates cost around $289 a year with few listed authorities and no free-tier equivalent, and one 2025 assessment found essentially no photos published online carrying credentials at all. Provenance answers a different question from detection, and answering it requires every hop to cooperate.

---

Status: established, moving quickly. Sources include the C2PA specification and conformance materials, adoption trackers updated April 2026, and vendor announcements. Several trackers are published by companies selling verification tools, which is stated where their figures are used.

---

What has actually happened

Content Credentials graduated from an industry specification to a formal ISO standard in 2025, ratified as ISO/IEC 22144.

That matters for a specific reason. An ISO standard can be referenced in government procurement, contracts and compliance frameworks without being treated as a vendor product, which is what turns a good idea into infrastructure.

Coalition membership passed 6,000 members and affiliates by early 2026, including the major model developers, platforms and camera manufacturers.

And the hardware shipped. Leica's M11-P in October 2023 was the first consumer camera to sign at capture, using a dedicated hardware security chip. Google's Pixel 10, from September 2025, signs every photo by default with hardware-backed keys and an on-device timestamping authority. Sony, Canon, Fujifilm and Panasonic have capable models; Samsung's Galaxy S25 signs only images that were AI-edited.

This is real adoption on a real standard, and it is worth saying clearly before the rest of the article.

The Nikon sequence

Nikon added signing to the Z6 III by firmware in August 2025. A critical vulnerability was then found in the signing implementation, and all issued certificates were revoked.

Revocation is retroactive. Every credential those cameras had already produced became invalid, including on photographs whose provenance was never in question.

As of early 2026 the certificate programme has not been restored.

The lesson is not that Nikon erred. It is that a provenance system concentrates trust in a signing key, and a compromise there invalidates history rather than just future output. A photograph signed by a compromised key is not merely unsigned; it carries a broken signature, which reads worse than no signature at all.

That is correlated exposure in the trust layer: every image from a device shares one dependency, and a single failure moves all of them together.

Signing outpaces verification

This is the structural finding, and it does not resolve with more adoption at the capture end.

Social platforms strip embedded metadata during upload, transcoding and re-encoding. This is not hostility to provenance; it is ordinary image pipeline behaviour that predates the standard and removes EXIF and IPTC data too.

The result is that signed content arrives at viewers unsigned. One assessment in 2025 put it bluntly: essentially no photos published online were carrying credentials.

The response is Durable Content Credentials, which combine the manifest with invisible watermarking and fingerprinting so an identifier survives transcoding and can be matched back to a cloud record. Adobe additionally lets a credential be published to a cloud service so verification survives loss of the embedded data.

Both are workarounds for a pipeline that discards the thing. They are reasonable, and they mean the guarantee is now "we can probably recover this" rather than "this is cryptographically attached".

And verification has to happen at the display surface. Google reports credential verification rolling out across Gemini, Search and Chrome, which is the layer that matters, and it arrived after several years of signing.

The certificate problem

Trust depends on a certificate authority appearing on the C2PA trust list. Content signed by an unrecognised authority displays as an unknown source, which is close to worthless.

Certificates cost around $289 a year, few authorities are listed, and there is no free-tier equivalent of the sort that took web encryption from a minority practice to the default.

That comparison is the useful one. HTTPS went from rare to universal when the cost of a certificate went to zero and browsers began marking its absence. Provenance currently has the price of the old regime and none of the browser pressure.

Which sets who can participate. A newsroom or a manufacturer can absorb $289 a year. An individual photographer, a small publisher or a citizen recording something cannot, and those are precisely the sources whose authenticity is most often disputed.

What it is not

Content Credentials record what was declared at signing. They provide provenance, not detection.

A signed image is not a true image. It is an image whose origin and edit history are attested by a key someone controls. If the scene in front of the camera was staged, the credential faithfully records the capture of a staged scene.

And an unsigned image is not a fake one. It is an image from a device without the feature, or one that passed through a pipeline that stripped it, which currently describes almost everything.

This distinction is where the standard is most likely to be misread in public use. A verification badge invites the reading "this is real". It means "this chain checks out", and the two come apart in exactly the cases that matter.

Why it is still the right direction

Detection degrades as generation improves. Every classifier is training data for the next generator, and real-world detection accuracy already runs at roughly half of benchmark accuracy.

Provenance does not have that property. A signature verifies or it does not, and improving image generation does not weaken a cryptographic check.

Which is the refutation cost argument applied correctly. Detection asks the expensive question, does this look real, on every item forever. Provenance asks a cheap question, does this chain verify, and moves the cost to the party making the claim.

The catch is that it only works if the chain survives, and the chain currently does not.

Three things this establishes

A trust root is a single point of failure, and revocation is retroactive. One signing vulnerability invalidated every credential a camera line had produced. Any provenance design has to answer what happens when a key is compromised, and the honest answer today is that history breaks.

Adoption at capture is the easy half. Signing is a device feature a manufacturer can ship alone. Verification requires every intermediary to preserve the data and every display surface to check it, which is a coordination problem rather than an engineering one.

And cost decides who gets to prove anything. At $289 a year with no free tier, provenance is available to institutions and not to individuals, which inverts the distribution of who most needs it.

What it does not establish

That the standard is failing. ISO ratification, 6,000 members and default signing on a mainstream phone in under three years is fast for infrastructure of this kind.

That metadata stripping is deliberate. It is ordinary pipeline behaviour, and platforms including LinkedIn, TikTok and Cloudflare are reported to preserve or support credentials at scale.

That durable credentials do not work. Watermarking plus fingerprinting is a reasonable engineering answer and its real-world recovery rates are not something this article has verified.

And nothing about any specific image or dispute. Every claim here is about the system.

What is unresolved

Whether a free certificate tier appears. This is the single change most likely to move adoption, and nobody has announced one.

Whether display surfaces converge. Verification in Search and Chrome is significant and it is one vendor's surfaces.

How durable the durable credentials are. Recovery rates through real platform pipelines, at scale, are not published.

And what a compromised key does at scale. The Nikon case affected one camera line. The same failure at a phone vendor signing by default would invalidate credentials on a far larger population, and no public analysis addresses that.

The counter-argument

Much of this tracking is published by verification vendors. Adoption trackers, conformance guides and inspector tools are largely produced by companies selling provenance services, and a narrative of rapid adoption with remaining gaps is commercially ideal for them. The ISO ratification and the vendor announcements are checkable; the adoption percentages are not.

The Nikon case may be a maturity problem rather than a design flaw. Early implementations of any cryptographic system have vulnerabilities, revocation working as designed is evidence the system functions, and reading one firmware bug as structural overstates it.

The HTTPS comparison flatters the argument. Web encryption had a browser duopoly able to force adoption by marking unencrypted sites as insecure. No equivalent actor can mark unsigned images as suspect, because most images are legitimately unsigned and would be for years, so the mechanism that solved the certificate cost problem is not available here.

And provenance may not need universal coverage. For the cases that matter, a disputed news photograph, a court exhibit, an official recording, institutional signing may be sufficient, and demanding that a citizen's phone footage carry credentials sets a bar the system was never designed to meet.

The short version

Content Credentials became ISO/IEC 22144 in 2025, the coalition passed 6,000 members, and Google's Pixel 10 now signs every photo by default with hardware-backed keys. Leica shipped the first signing camera in October 2023. This is genuine infrastructure moving quickly.

Then Nikon added signing to the Z6 III, a critical vulnerability was found in the implementation, and all certificates were revoked, invalidating every credential those cameras had produced. Revocation is retroactive, and as of early 2026 the service has not been restored.

The structural issue is that signing outpaces verification. Platforms strip embedded metadata during ordinary transcoding, so signed content reaches viewers unsigned, and one 2025 assessment found essentially no photos published online carrying credentials. Durable Content Credentials add watermarking and fingerprinting to recover an identifier, which is a workaround for a pipeline that discards the original guarantee.

And the certificate layer decides who participates. Around $289 a year, few listed authorities, no free tier. HTTPS became universal when certificates became free and browsers began marking their absence. Provenance has the price of the old regime and no equivalent pressure.

It is still the right direction, because detection degrades as generation improves and a cryptographic check does not. Provenance asks a cheap question and moves the cost to whoever is making the claim. It just requires the chain to survive the journey, and today it usually does not.

Common questions

What are Content Credentials? A cryptographic record of where a piece of media came from and what was done to it, attached at capture or creation and carried forward through editing. The specification became a formal ISO standard in 2025, ratified as ISO/IEC 22144, which allows it to be referenced in government procurement, contracts and compliance frameworks without being treated as a vendor product.

How widely is it adopted? On the capture side, substantially. Leica's M11-P shipped the first signing camera in October 2023 with a dedicated hardware security chip, Google's Pixel 10 signs every photo by default using hardware-backed keys and an on-device timestamping authority, and Sony, Canon, Fujifilm and Panasonic have capable models. Samsung's Galaxy S25 signs only AI-edited images. Coalition membership passed 6,000 members and affiliates by early 2026.

What happened with Nikon? Signing was added to the Z6 III by firmware in August 2025, a critical vulnerability was found in the signing implementation, and all issued certificates were revoked. Revocation is retroactive, so every credential those cameras had already produced became invalid, including on photographs whose authenticity was never questioned. As of early 2026 the certificate programme has not been restored.

Why does that matter beyond one camera line? Because it shows a provenance system concentrates trust in a signing key, and a compromise there invalidates history rather than only future output. An image signed by a revoked key carries a broken signature, which reads worse than no signature at all. The same failure at a phone vendor signing by default would affect a far larger population, and no public analysis addresses that scenario.

Why does signed content arrive unsigned? Because social platforms strip embedded metadata during upload, transcoding and re-encoding. This is ordinary image pipeline behaviour that predates the standard and removes EXIF and IPTC data as well. One 2025 assessment found essentially no photos published online were carrying credentials. Durable Content Credentials combine the manifest with invisible watermarking and fingerprinting so an identifier can be recovered and matched to a cloud record, which is a workaround rather than a fix.

Does a Content Credential mean an image is true? No. It records what was declared at signing, which is provenance rather than detection. A credential faithfully attests the capture of a staged scene if that is what was captured. Equally, an unsigned image is not a fake one; it is an image from a device without the feature or one that passed through a pipeline that stripped it, which currently describes almost everything.

Why does the certificate cost matter? Because trust requires the signing authority to appear on the C2PA trust list, and content signed by an unrecognised authority displays as an unknown source. Certificates cost around $289 a year, few authorities are listed, and there is no free-tier equivalent. HTTPS became universal when certificates became free and browsers started marking their absence. Provenance has the price of the old regime and no comparable pressure, which restricts participation to institutions rather than individuals.

Is provenance still the right approach? On the evidence, yes, with the caveat that it is incomplete rather than working. Detection degrades as generation improves, since every classifier becomes training material for the next generator and real-world accuracy already runs at roughly half of benchmark accuracy. A cryptographic check does not weaken as image generation improves. Provenance also asks a cheaper question, whether a chain verifies rather than whether something looks real, and places the cost on whoever is making the claim. It requires the chain to survive every hop, and today it usually does not.