GoKawiilResearcher shows C2PA timestamp signatures can be spoofed to fake 'proof' photos
Security researcher David Buchanan demonstrated a technique to forge the Time Stamp Authority signature used in C2PA content provenance metadata, producing an image that appears cryptographically verified as existing hours before it actually was created. He used the trick to generate a fake photo showing winning lottery numbers displayed before the official draw, verifiable via Adobe's Content Authenticity tool. Buchanan says the stunt builds on an earlier finding that the underlying 'claim' signatures in C2PA, including those from flagship camera apps, can already be forged.