On the Internet of Authenticity, who makes the trust decisions?

The cryptography works. A signed asset can be checked: a verifier confirms the bytes are unchanged, the signature is valid, and a particular key produced it. That part is finished engineering.

The signature belongs to somebody. Should you believe them? Mathematics has nothing to say about it, and the specifications admit as much.

The standard says the question is open

The Creator Assertions Working Group defines how an identity assertion binds a named actor to a signed asset. The identity claims aggregation credential is the mechanism, and the specification is precise about the cryptography: the credential is secured with a COSE signature, the issuer is identified by a decentralized identifier, and the issuer’s public key must be discoverable through a publicly documented DID method.

That first requirement carries more weight than the acronym suggests. COSE — CBOR Object Signing and Encryption, RFC 9052 — wraps a piece of data together with a signature over it. The credential is the payload, the signature covers it, and a verifier checks that signature against exactly the bytes in front of it.

Exactly is the operative word. The specification states that the unsecured credential is the payload, unmodified. Nothing is reformatted, reordered, or looked up on the network before the signature is checked. Some credential formats work the other way: they transform a document into a normalized form first, which can involve fetching definitions from remote servers, and the signature covers the transformed result rather than the bytes in front of you. Those formats exist for good reasons, but they make what a signature covers depend on something outside the document. CAWG chose the simpler and stricter path. What you verify is what you were given.

Then the specification says this, in the section on validating such a credential:

As of this writing, the Creator Assertions Working Group has not provided guidance about which identity claims aggregators to consider trusted.

Validators are instructed to maintain their own lists. One list of issuers considered trusted. One list of trust anchors considered trusted. The specification defines exactly how to check a signature and explicitly declines to define whose signatures deserve checking.

Implementations make the gap concrete. The reference Rust implementation compares the issuer’s identifier against a configured allow-list using exact string matching. That is a reasonable engineering decision. It is also a complete description of the state of the art: a signer is trusted because someone put a string in a configuration file.

Two statements, one of them unearned

Provenance gets described as proof of origin. A verifier actually produces two different statements, and they are not equally solid.

The first is a fact about bytes. This file has not changed since signing. The signature is valid. Nobody has to be trusted for that statement to hold, and the statement is genuinely valuable.

The second is a claim about the world. This was published by a particular news organization. That claim is not established by cryptography at all. Cryptography establishes that whoever held a key made the claim. Everything else — that the key belongs to that organization, that the organization is what it says it is, that the organization has any standing worth caring about — comes from somewhere outside the signature.

Most provenance products answer the second question themselves. The vendor checks the customer, issues the credential, and shows the result in its own verification tool. The checks are usually real. But the answer to “who says this publisher is real?” is “the company selling the provenance service”, and the reader cannot weigh that judgement because it was never published.

For a reader, then, “verified” means the signer appeared on a list. Which list, maintained by whom, on what evidence, is usually not visible.

Accreditation is the part that already exists

Journalism has spent years building the missing piece, in a form that has nothing to do with cryptography.

The Journalism Trust Initiative assesses news organizations against a published standard covering ownership transparency, editorial independence, corrections policy, and sourcing practice. Reporters Without Borders and similar bodies do related work. The assessment is performed by an accreditation body, against public criteria, with a process anyone can read.

That differs from a vendor’s identity check in one way that matters: the authority behind it can be examined. Read the standard, decide what the certification is worth, disagree with the assessment and say why. An internal verification process offers nothing to argue with, because its criteria are not public.

So the useful move is to carry the accreditation as a credential — issued by the certification body, bound to an identifier the publisher controls, and resolvable by anyone. Then a signed article carries two things at once. The provenance of the work: who wrote it, what changed, where the components came from. And the standing of the publisher: an accredited news organization, with the accreditation traceable to the body that granted it.

Those two together are the signal a person or an application can actually act on. Either one alone falls short. Provenance without standing tells you a file is intact and leaves you to guess who made it. Standing without provenance is a badge on a web page.

What this does and does not solve

Publishing standing as a resolvable credential does not eliminate trust. Trust cannot be eliminated. Somebody always vouches. What changes is who does the vouching and whether their reasoning is inspectable — the choice between a hierarchy, a web of peers, and a curated set of anchors, which we worked through in Hierarchy, Democracy, Anarchy? Choose Your Trust Model. Moving the judgement from a provenance vendor to an accreditation body relocates trust to an organization whose entire purpose is making that judgement in public, against criteria it has published.

It also does not settle the standard’s open question. Deciding which identity issuers to trust remains, correctly, a decision for whoever operates a verifier. What an accreditation credential provides is evidence to make the decision with, and a shape for the answer that does not require every verifier to trust the same commercial party.

The cryptography is finished. What remains is governance: publishing who vouches for whom, on what basis, in a form other people can check. Until that happens, “verified” does far less work than readers assume it does.