Passport photos

A capture device signs a photograph at the moment it is taken, and the holder publishes a content-authenticity claim to a public register, so any receiver can confirm the image later without contacting the party that recorded it. Because the receiver checks the signature against the capture device's pinned key, bound to the holder's mandate, a photo substituted by an untrusted party fails the check, with no central authority in the loop.

The problem, from the domain

Identity documents depend on a photograph that was taken of the right person, at a known moment, and has not been changed since. On the path from the camera to the finished document, that image passes through several hands and several systems. Each handover is a chance for a photo to be swapped, retouched, or replaced with a synthetic likeness. By the time a manipulated image reaches the desk that prints or approves a document, the people involved have no reliable way to tell an original capture from a convincing forgery.

The usual defences are procedural: trusted suppliers, secure transfer, and after-the-fact investigation when something looks wrong. These reduce risk, but they do not let a receiver prove, on its own, that the specific image in front of it is the one the camera produced. The content-authenticity taxonomy moves the point of trust to the moment of capture itself.

Any public body exploring this kind of exchange does so as a pilot or exploration. Nothing here describes a live service, and the problem framing stays generic across the many document chains where a photograph has to be trusted.

How the exchange works

This content-authenticity taxonomy is a domain taxonomy on the base protocol. At the moment of capture, a capture device signs the photograph on behalf of a holder, for example a capture operator who controls the signing key. The signature binds the image to the moment and the device that produced it.

The holder then publishes a content-authenticity claim to the protocol's public register. Only a cryptographic commitment to the image is anchored on the public audit layer. The photograph itself is never placed there, so the register carries proof, not personal data.

An identity-document issuer, or any other receiver, verifies the claim independently, with three checks:

1. The capture signature. Was the image signed at the moment of capture, by a key the holder controls?
2. The anchor proof. Does the registered claim correspond to the commitment recorded on the public audit layer?
3. The recomputed commitment. When the receiver legitimately holds the file, does recomputing the commitment from that image match what was anchored?

All three checks pass together, or the claim fails. There is no call back to the recording party and no central authority in the loop.

Relationship to C2PA

C2PA is an open content-provenance standard that specifies an embedded manifest travelling inside the file. This taxonomy is complementary to it. Where C2PA describes the provenance that moves with the image, the taxonomy adds independent anchoring, publication to a public register, and discovery, so a receiver can find and verify a claim even when the file arrives without its manifest.

What this contrasts with

The status quo is procedural trust: a receiver relies on the reputation of the supplier chain and on secure transfer, and can only investigate after the fact. That approach keeps working right up until an image is substituted somewhere no one is watching. The protocol does not replace suppliers or handling procedures. It adds a check any receiver can run alone, so authenticity no longer depends on trusting every hand the photograph passed through.

Where to go deeper

• The normative rules: the content-authenticity spec.
• The exchange patterns: one-to-many and register lookup.
• Common questions: the FAQ.