Content Credentials
Media published on thonly.org carries its provenance in the file, and a signature over the exact bytes.
Each image says what it is — a photograph, a photograph enhanced with AI, or made by AI — along with who is depicted, on whose consent, and where that is disclosed in words. The signature says those bytes have not changed since they were signed.
The certificate
| Signing certificate | CN=thonly.org media signing, O=Thon Ly, C=US |
| Issued by | CN=thonly.org media root, O=Thon Ly, C=US |
| Valid | Sep 19 17:55:58 2026 GMT → Sep 18 17:55:58 2031 GMT |
| Root fingerprint (SHA-256) | 3A:5F:8E:B1:4F:59:12:41:F5:D5:B7:0B:7D:23:36:A0:11:B7:9B:AF:30:E9:0E:06:BB:61:91:7F:15:0E:CB:C8 |
| Files | signing-chain.pem · root.pem |
What the signature does and does not say
It says: these bytes have not changed since they were signed, by the holder of the key published here.
It does not say the claim is true. That is what the written disclosure, the public register of this estate's AI media, and a hash of the picture itself are for.
The root is ours, not a certificate authority's. A public verifier will report the issuer as unknown, and that is the honest state: nothing here asks you to trust a third party's opinion of us. Check the signature against the certificate on this page instead. A certificate from an authority on the C2PA trust list requires a registered organisation, which this publisher does not yet have.
Checking a file
brew install c2patool # or: cargo install c2patool c2patool <file> # the manifest, its assertions, and the signature's state
To pin trust to this publisher rather than the public list:
c2patool trust --trust_anchors https://thonly.org/.well-known/c2pa/root.pem c2patool <file>