Yes, that is a great point!

I think we should encourage preserving the data as first class, and with Pixelfed, we have a few optional drivers that are quite performant and could handle this, but and this is where it gets tricky, what you identified as a potential issue with malicious provenance rewriting is really no different than what we would get from servers who strip this during optimization (like Mastodon) and can only really “hope for the best” when it comes to displaying this for users.

I guess it’s up to each implementation on how they want to signal this in their UI, being able to verify the credentials on your own server could be an option for those that want strict provenance chain of custody.