Trust chains in the extension
A trusted C2PA result requires more than a mathematically valid signature. The signing certificate must also chain to a recognized trust source.
From media signature to recognized trust source
How end-entity certificates connect through issuers to public trust.
- End-entity certificateThe certificate that signs the C2PA manifest or claim.
- Intermediate certificateAn issuer certificate that connects the signing certificate toward a trust source.
- Recognized authorityA trust anchor or recognized source used to decide public trust status.
How the extension evaluates the path
Signature validity, certificate path and recognized trust source are separate checks.
| Step | Question | Possible outcome |
|---|---|---|
| Signature | Does the signature validate against the manifest and media? | Invalid if signature or integrity validation fails. |
| Certificate path | Can the signing certificate be linked to an issuer chain? | Not recognised if the signature is valid but public trust is not recognized. |
| Trust source | Does the chain terminate in a recognized C2PA trust source? | Trusted when the evidence and chain are valid and recognized. |
Local-first security
Trust evaluation is designed to support local review.
- Media files are not uploaded to a ProvSeal backend for trust-chain inspection.
Why a valid signature may not be recognised
Cryptographic validity and public trust recognition are not the same outcome.
The signature can be cryptographically valid while the certificate chain is not recognized as public trust.
The media has valid C2PA evidence and the signing certificate chains to a recognized trust source.