Signed but untrusted is one of the most misunderstood C2PA outcomes. It does not mean the file is fake. It usually means cryptography succeeded while trust policy did not. Security and editorial teams see this status daily during pilots — often triggering unnecessary escalations until trust design is documented.
This article walks through signature validation versus trust evaluation, the role of X.509 chains, and practical steps to resolve or correctly accept untrusted outcomes in production workflows.
Valid signature versus trusted signer
Signature validation confirms that manifest bytes match the embedded signature and that the signing certificate was valid at signing time. Trust evaluation asks an additional question: does this certificate chain terminate on a source your organization recognizes?
Think of validation as “was this manifest tampered with since signing?” and trust as “do we accept this signer for publication?” A self-signed development certificate can pass the first test and fail the second — by design.
ProvSeal separates these layers so reviewers can distinguish broken signatures from policy mismatches.