How 29a.ch Explains C2PA Content Credentials for Photo Forensics

29a.ch is the personal website of Jonas Wagner, and its photo forensics tool, Forensically, added support for reading C2PA metadata. C2PA (Coalition for Content Provenance and Authenticity) is a technical standard for certifying the source and history — the provenance — of media content. In Forensically, that means you can inspect signed provenance data attached to a photo, but the site is explicit that the signatures should be treated with caution rather than as proof of trustworthiness.

What C2PA actually certifies

According to the description on 29a.ch, C2PA addresses misleading information online by developing technical standards for certifying where media came from and what happened to it. The metadata is signed and optionally timestamped using a timestamp authority.

So the standard aims to answer two questions: who or what issued the provenance claim, and when. That is a narrower promise than "this image is authentic."

Why a valid signature is not the same as trust

Jonas Wagner's article makes the key limitation explicit: digital signatures do not inherently guarantee trustworthiness. Even if the scheme is cryptographically sound, you still need to trust everyone and everything with access to the keys.

That distinction matters when you are reading a verification result. A signature proves that a key signed some data. It does not prove that the signer was honest, that the key was not compromised, or that the captured moment was real.

What the tooling actually reveals

The article notes that the C2PA JavaScript library does not surface much useful information — essentially just the organization of the subject. The example signature info shown is limited to fields like:

The public verifier at contentcredentials.org/verify is described as similarly thin. It maintains a "known certificate list" and an email address for submitting a certificate to be included, but the article states uncertainty about what is validated before a certificate is added.

The practical takeaway from the author: take the signatures displayed in Forensically with a big pinch of salt.

Privacy: remote manifests as potential beacons

C2PA supports remote manifests, which can make sense in some cases — for example, keeping an asset's file size small. But the article points out they can also be used as beacons to track a person viewing the metadata.

For Forensically, remote manifest support was deliberately disabled, both through configuration options and by blocking requests with a Content Security Policy. If you are evaluating any C2PA-aware tool, this is a concrete question to ask: does it fetch remote manifests, and can that fetch leak the fact that you opened the file?

Implementation cost worth knowing

The article also records a practical constraint: the c2pa-js library is large. In the author's Vite setup it compiles to roughly 350 kB for the main ES module, 165 kB for a worker, and 5.4 MB for the WebAssembly module. That is relevant if you are considering embedding C2PA reading into your own tool — the capability is not lightweight.

How to use this when analyzing a photo

• Treat a C2PA signature as one signal about provenance, not a verdict on authenticity.
• Check who issued the certificate and whether you have any reason to trust that issuer.
• Note whether the manifest is embedded or remote; remote manifests can be fetched from a third party when the file is opened.
• Cross-check with other forensic signals rather than relying on the credential alone.

The core lesson from 29a.ch is that C2PA adds verifiable provenance claims to the analysis, but the trust decision still rests with the person reading the result.