Thank you for working on this proposal. I have a concern about relying on server-reported validation summaries when the distributed image no longer contains its original C2PA manifest.

If a server re-encodes an upload, removes the manifest, and does not sign the derivative, recipients must trust the publisher’s contentCredentials summary. They cannot independently verify that report against the distributed file.

For example, a malicious server could distribute AI-generated images while claiming that they were camera captures with Trusted credentials. A recipient relying solely on those fields would have no cryptographic evidence with which to challenge the claim. It could end up displaying misleading provenance information based entirely on the publishing server’s assertions.

I appreciate that the proposal explicitly identifies the summary as a publisher’s claim. My concern is that, without an independently verifiable asset, trust in the publishing server becomes the sole basis for accepting that claim.

I suspect many smaller instances will be unable or unwilling to take on the cost and operational responsibility of maintaining trusted signing credentials. The optional signed-derivative approach may therefore see limited adoption.

Could preserving and exposing the original signed asset be considered a first-class alternative? This would retain the existing signature without requiring the publishing server to operate its own signing infrastructure. Recipients could independently validate the original using their clients, browser extensions, or external C2PA verification tools.

This would not make every provenance claim inherently truthful, but it would allow recipients to check the signature, assess the signer, and verify the manifest’s binding to the actual file, rather than relying solely on a server-reported result.

In this model, additional ActivityPub properties would not be necessary for cryptographic verification, since the evidence remains available in the original file.

Preserving the original would require explicit author consent, since the file may contain sensitive metadata, including location information. An optimized derivative could still be provided for display, with a clear distinction between that derivative and the signed original.