Every provenance system eventually runs into the same wall: the platforms your audience actually uses will re-encode your file, and most of them will throw away the metadata while they do it. The 2.2 revision of the specification is largely an answer to that wall.
For the past two years the practical advice to creators has been to publish signed originals somewhere you control, and to accept that reposts lose their credentials. That advice is starting to change, and the reason is a quiet expansion of what counts as a binding.
Hard bindings and soft bindings
A hard binding is a cryptographic hash of the asset bytes. It is exact and unforgiving: change one pixel and the binding breaks, which is precisely the point. A soft binding is a perceptual fingerprint, a compact descriptor of what the content looks or sounds like, robust to the transformations a platform applies on upload.
The two are complementary. The hard binding proves an exact file is untouched. The soft binding gives you a way back to the manifest when the exact file no longer exists anywhere in the distribution chain.
The question was never whether we could sign a file. It was whether the signature could survive contact with a real distribution pipeline.
Working group notes, March 2026
What the revision actually adds
Three changes are worth your attention.
- Soft binding algorithm identifiers are standardised, so a fingerprint computed by one tool can be looked up by another.
- A recovery flow is defined: given a stripped asset, a verifier can query a manifest repository by fingerprint and retrieve the original credentials.
- The assertion vocabulary around AI training and generation is tightened, which matters for anyone who needs to state clearly that a work is not synthetic.
None of these are new ideas. What is new is that they are written down the same way in every implementation, which is the part that makes interoperability possible.
What it means in practice
If you publish to a platform that strips metadata, a viewer running a compliant verifier can still recover your credentials, provided your fingerprint is registered somewhere they can reach. That last clause is doing a great deal of work, and it is where the next year of implementation effort will go.
Registration is the unglamorous half of the problem. A fingerprint nobody can look up is a fingerprint nobody will find.
Where it still falls down
Heavy crops defeat the current fingerprints. So does a hard aspect ratio change, which is exactly what happens when a landscape frame gets reformatted for a vertical feed. If your work routinely gets reframed, the hard binding on your original remains the thing to point people at.
Short video is harder again. The descriptors were designed for stills first, and it shows.
What to do now
- Keep publishing a canonical signed copy under a domain you control.
- Register fingerprints for anything you expect to be reposted widely.
- Treat recovered credentials as a helpful signal, not as proof of an exact file.
None of this removes the need for a canonical original. It just means the copies that escape are no longer completely orphaned, and that is a meaningful improvement on where we were a year ago.