A valid signature is not the same as a trusted signer
Why integrity, identity and editorial truth belong on separate lines of an inspection report.
The short answer
A valid cryptographic relationship does not by itself establish that a signer is trusted or a scene is true. Trust depends on an explicit policy and accepted credentials. C2PA Studio does not load a trust list or fetch current revocation information, so identity trust remains a separate, unperformed check.
Source context: C2PA trust model and validation specification. The workflow recommendations below are editorial analysis.
Do not compress three decisions into one badge
A signature check is useful only when its scope is understood. Imagine receiving a signed declaration from an organization you have never heard of. You might be able to examine the file’s cryptographic relationships without deciding that the organization is credible. You would still need a policy for whose identity you trust and what their declaration means in context.
This tool therefore separates an embedded-record result from identity trust. The offline inspector does not load a trust list or obtain fresh revocation information. Its “not checked” label is an important part of the result, not an error to hide after finding a manifest.
Make the trust policy explicit
For a newsroom or studio, write the relevant trust question before selecting a verifier. Are you accepting a vendor’s processing declaration, a camera-origin statement or a named contributor’s identity? Which issuing authorities and credential profiles are accepted? Who owns updates to that policy? An unnamed default inside an application is difficult to defend in a sensitive review.
If another verifier reports an identity as trusted, preserve its configuration and date with the result. Two tools using different trust policies need not produce identical badges. Investigate the difference in inputs and settings before describing one result as wrong. That comparison is especially important for offline and online checks.
Keep the editorial conclusion independent
Even a correctly identified signer can describe a misleading scene. A staged event, inaccurate caption or missing context does not necessarily damage a file binding. Give your editorial reviewers the provenance record as supporting evidence and let them assess the broader claim with their normal reporting process.
For an internal report, use three concise sentences: which copy was inspected, what validation issues were reported and which identity checks were or were not performed. Then add the editorial decision separately. That wording reduces the chance that a client will treat an inspection PDF as a certificate of factual truth.
A comparison for your review
| Decision | Evidence to examine | Who should own it |
|---|---|---|
| File integrity | Binding and signature validation | Technical reviewer |
| Signer identity trust | Named policy and accepted anchors | Security or trust-policy owner |
| Meaning and truth | Context and independent evidence | Editorial reviewer |
Put it into practice
- Record inspection scope.
- Name the trust policy used by a second verifier.
- Preserve validation codes.
- Keep editorial conclusions separate.
Bring your own evidence.
Inspect a local file and see what it actually declares.