We aren’t talking apples in a supermarket here; Provenance can’t just be a sticker we slap on.C2PA got the instinct right — and made two structural choices that break exactly when provenance starts to matter. "When it matters" now has a date on the calendar.*In a world where anything can be generated, "what do we trust?" is no longer a philosophical question. Provenance — a verifiable record of where a thing came from and what happened to it — is becoming infrastructure: for media today, for AI systems next. The industry has largely converged on C2PA (Content Credentials) as the answer for media. It's a signed record of a piece of content's origin and edit history, attached directly to the content, developed by a coalition of more than 6,000 member organizations including Adobe, Microsoft, major camera makers, and newsrooms. That is genuinely good engineering aimed at a genuinely urgent problem. A cryptographic chain of custody for media is the right instinct. But C2PA made two structural choices that are backwards for the problem coming next. It binds provenance to the asset, and it roots trust in a central authority. Both feel like conveniences. Both are the seams an adversary reaches for first. And neither holds up once the thing you need to prove stops being a photo and starts being what an autonomous system did.Mistake 1: The record is a sticker — and stickers come offC2PA's primary mechanism is the "hard binding”: a cryptographic hash of the asset, carried in a signed manifest embedded in the file's metadata. While that manifest rides along with the file, verification works. You can check the signing chain and read the asset's claimed history. The problem is the phrase “rides along”. Provenance that travels attached to a file can be detached from the file. Re-encode it, screenshot it, crop it, push it through a platform's upload pipeline — routine operations that happen to nearly every image crossing the internet. The IPTC has been running platform metadata tests for over a decade, and the results are consistent: most major social platforms remove embedded metadata somewhere between upload and download, often as an unintentional side effect of resizing.The C2PA's designers know this. That's why the spec defines "soft bindings" — invisible watermarks or content fingerprints for recovering a manifest "when the metadata containing the C2PA Manifest has been stripped." It's a real mitigation. It also trades one weakness for another. Invisible watermarks have hard robustness limits: a NeurIPS 2024 paper demonstrated regeneration attacks that provably remove pixel-level invisible watermarks while preserving image quality. And when the watermark is a lookup key, verification now depends on a manifest repository being online, honest, and well-governed — the C2PA's own implementation guidance notes that users must trust the repository operator not to manipulate or remove what's stored there. You don't remove the trust problem. You relocate it. And here's the part that should bother anyone treating this as a serious trust signal: the absence of a credential is indistinguishable from never having had one. Strip the manifest and the asset doesn't announce it was tampered with. It just looks like unsigned content — which is most content on the internet. The system is informative precisely when the record survives, and silent precisely when the record has been removed.Mistake 2: Trust roots in a listThe deeper problem is where trust actually lives. A C2PA signature is only as meaningful as your willingness to trust the entity that issued it. By the C2PA's own description, the C2PA Trust List is a curated list of certificate authorities, and only products vetted through the conformance program's Administering Authority are eligible for signing certificates. Timestamps get the same treatment: there's a separate curated trust list of approved time-stamping authorities that act as third-party notaries.Curated PKI isn't crazy — it's roughly how the web's certificate system works, and it scales. But whoever administers the list effectively defines what "authentic" means. That's a governance question wearing a cryptography costume. For a standard meant to underwrite “public” trust, a curated central anchor is a single point of policy, capture, and failure.Two pieces of running infrastructure show the list isn't the only possible root: Certificate Transparency exists because pure authority-trust failed on the web. Certificate authorities mis-issued, so the ecosystem added publicly verifiable, append-only logs (RFC 6962) that let anyone detect misissuance. Even the web's PKI had to bolt verifiable logs onto its authorities to stay honest. - OpenTimestamps commits hashes into the Bitcoin blockchain, and the resulting proofs verify against a local node — no timestamp authority's word required. Decentralized, independently checkable timestamping isn't hypothetical. It's free and running today. Centralize the authority that can issue or revoke provenance, and you've centralized the one fact provenance was supposed toNow point this at agents, not just imagesSo far the provenance conversation has mostly been about deepfakes and media. The bigger version is arriving fast: proving what an autonomous system did, and when, in a way that can't be stripped or forged after the fact. As agents gain tool access and start acting in the world — writing to systems, moving value, sending messages — the record of those actions becomes the thing that actually matters. Regulators have reached the same conclusion. Article 12 of the EU AI Act requires high-risk AI systems to automatically record events across the system's entire lifetime, and those obligations apply in full to high-risk systems on August 2, 2026. The audit trail is no longer a nice-to-have. It's the deliverable. Build that record the C2PA way — attached to the artifact, trust rooted in a central authority — and you inherit both structural flaws in the exact setting where they hurt most. An audit log you can detach is not an audit log. A provenance authority you have to trust is the exact thing provenance was supposed to make unnecessary.The shape that actually worksIf the flaw is attached records anchored in central trust, the fix isn't a better signature format. It's a different shape.Four properties:Provenance as a property of the system, not a sticker on the file: Move the record beneath the asset, down to the system that produced the work. The record is something that system holds and maintains — not something bolted onto the artifact and shipped into the wild to fend for itself.Tamper-evident and chained: Each entry cryptographically linked to the one before it, transparency-log style. Rewriting the past doesn't quietly succeed — it breaks the chain visibly. The goal isn't tamper-*proof*. It's tamper-*evident*. That distinction is the whole point.Verifiable without a central authority: No trust list to curate. No issuer hierarchy that can be captured. No timestamp notary you take on faith. Verification is public math anyone can run against the record itself — the way a Certificate Transparency proof or an OpenTimestamps proof already works.Held locally, by the operator: The record lives on hardware the accountable party controls and can export — not in a cloud they can't audit. The party with the most at stake in the truth is the party that holds it. None of this is exotic. Append-only structures, Merkle proofs, and transparency logs are deployed, boring technology. This is what any serious audit trail should have been all along.C2PA reached for convenience — attach it, let authorities vouch — because convenience is what gets standards adopted. The convenience is also the vulnerability. It works until the record is stripped or the authority is captured. Which is to say: it works until it matters. We're going to spend the next few years deciding what provenance is anchored in, and right now we're deciding mostly by default. It's worth choosing.