The C2PA Trust List is part of the trust infrastructure used to evaluate whether a Content Credential was signed by a recognized source.
When a C2PA validator checks a file, it does not only verify that the manifest signature is mathematically valid. It may also check whether the signing certificate chains back to a certificate authority or trust source recognized by the C2PA ecosystem.
This distinction is important because a signature can be valid without being publicly trusted. See also Security & Trust and Limitations.
Why the C2PA Trust List matters
A Content Credential can have different trust outcomes:
- the manifest may be valid and trusted;
- the manifest may be valid but signed by an unknown or test certificate;
- the manifest may be invalid because integrity or signature validation failed;
- the file may contain no detectable C2PA evidence.
The C2PA Trust List helps validators distinguish between a valid signature from a recognized trust source and a valid signature from an unknown or non-publicly-trusted source — often shown as Signed but untrusted.
Trust List vs local trust
The C2PA Trust List is designed for ecosystem-level trust. A company or internal team may also use its own trust policy for private workflows, pilots or sandbox environments.
For example, a local test certificate can be useful for demos and development, but it should not be presented as publicly trusted unless it chains to a recognized trust source.
C2PA Trust List in ProvSeal
ProvSeal displays clear verification statuses so users can understand the difference between trusted, signed but untrusted, invalid and missing credentials.
This is useful for testing workflows because developers and teams can see whether a file is simply signed, whether the signature validates, and whether the trust chain is recognized.
For the full guide, read C2PA Trust List.