Read the status first
Verified, invalid, untrusted, not found, unsupported and processing error are different outcomes. Expand technical details only after understanding the summary.
- Verified: cryptographic checks succeeded
- Invalid: a hash, signature or linked assertion failed
- Untrusted: a credential exists but trust could not be established
- Not found: no readable manifest store was present
Keep the interpretation narrow
Do not translate verified into real or not found into fake. Content Credentials document provenance claims; they are one evidence layer.
Preserve the input before you verify
Use the earliest available file rather than a screenshot, thumbnail or messaging-app derivative. Save a cryptographic hash if the chain of custody matters, because a later download with the same filename may not contain the same bytes.
Do not edit or clean the file before checking credentials. Metadata removal and conversion can invalidate or remove provenance structures, producing a not-found or invalid result that describes the derivative rather than the original.
- Keep the original bytes
- Record the source and time received
- Hash when identity of the file matters
- Verify before making a derivative
Read status, signer context and actions separately
Start with the overall validation status, then inspect the active manifest and claim generator. Review action assertions and ingredients as statements in the signed record; do not assume an omitted action never occurred before the signed history began.
Trust can depend on available certificates and configured trust lists. An untrusted status is not the same as an invalid asset, and a valid signature is not an endorsement of the depicted claim.
What our browser check covered—and did not
The release browser correctly treated a valid unsigned PNG as “No Content Credentials found” and kept error categories separate. This verifies a safe negative path and interface mapping.
It does not yet substitute for a full corpus of real signed, intentionally corrupted, revoked and expired credentials. Those files are explicitly listed as a final acceptance requirement, so the article does not claim broader cryptographic coverage than was tested.
What this does not prove
A metadata result describes the fields and structures that the supported parser could read. It does not, by itself, prove authenticity, intent, authorship or the truth of the visible scene.