C2PA camera provenance breaks under real Android threat models
Android camera-app implementations of C2PA rely on Key Attestation and Play Integrity to stop an app from signing arbitrary files, but root exploits and low-cost fault injection can defeat those guarantees. The author demonstrates that even the strongest current mobile assurance story cannot establish that signed pixels came directly from a sensor.
The HN discussion pushed the threat model further: sensor-level signing still leaves optical attacks such as photographing a screen, and several commenters questioned whether a signature can ever prove the real-world authenticity people infer from it.