The forged certificate problem is coming for ALL content provenance too
The forged certificate problem is coming for AI content provenance too
In February 2026, a judge at Southwark Crown Court sentenced Jose Alejandro Zamora Yrala to 4 years and 8 months in prison. Between January 2019 and July 2023, working alone from a home office in Surrey, he forged airworthiness certificates for more than 60,000 aircraft engine parts, most of them destined for the CFM56, the engine powering a large share of the world’s Boeing 737 and Airbus A320 fleet. The certificates were good enough that engineers accepted them for four straight years before one maintenance shop, in Portugal, bothered to check one part against the manufacturer.
Every provenance system you have ever built, from code-signing pipelines to SBOM attestations to the C2PA manifests now being pitched as proof that a human made a piece of content, has exactly the same seam Zamora Yrala found. The cryptography can be flawless and the fraud still gets through, because cryptography only protects the chain after someone decides who gets to hold the key.
The unnamed problem
The AI industry has spent most of 2026 arguing about detection. Watermark this output, mark that one, label the synthetic, tag the disclosed. will.i.am stood on a stage at Cannes Lions in June and pitched a “new file for humans,” a format that would carry proof of human authorship the way an airworthiness certificate carries proof a part is safe to fly.
That is the surface conversation. The conversation nobody is having is about who gets to issue the certificate in the first place. Every provenance scheme, human or machine, assumes the entity signing the assertion earned the right to sign it. Aviation had this exact conversation decades before AI content existed, and answered it with a global regulatory apparatus: type certificates, approved production organisations, EASA Form 1, FAA 8130-3, a licensed inspector corps, and a legal duty on every buyer to trace a part back to its manufacturer.
It still took four years and 60,000 parts before anyone noticed the forgery. Content provenance is at the beginning of the same reckoning, and none of that infrastructure exists yet.
Right now, most of what passes for “proof” in content platforms is self-declared. Spotify’s AI Credits and Apple Music’s Transparency Tags both run on the same principle as an unverified customs form: the distributor states whether AI was involved, and the platform takes the statement on trust. That’s a reasonable starting point. It’s also precisely the model AOG Technics operated inside for four years, and precisely the model a “new file for humans” would need to move past before the word “proof” means anything.
What a proof-of-anything system actually needs to survive
Six checks decide whether a signed claim is worth anything, and not one of them is about the strength of the cryptography.
-
Prove the identity behind the key
Zamora Yrala didn’t break any cryptography. He invented fictitious quality managers who would “confirm” his forged certificates by email, so that anyone who checked found a plausible person on the other end. EASA later worked back through the paper trail, part number by part number, and found the named manufacturers had no record of producing the certificate at all.
A C2PA manifest or a code-signing certificate proves that whoever held the private key asserted something. It says nothing about how rigorously that identity was checked before the key was issued, and the relying party usually has no way to find out. A domain-validated certificate and an identity-validated one look identical the moment they start signing.
TLS at least has a tiering convention for this: domain validation, organisation validation, extended validation, each requiring progressively more identity checking before a certificate authority signs. Content-authorship credentials have no equivalent tiering yet. A “verified human” badge and a “somebody typed an email address” badge would currently look the same.
The action: publish the identity-proofing tier behind every signing key you issue or accept. A validating signature alone tells the relying party nothing about who earned the right to hold it.
-
Keep the instrument that issues certificates separate from the party claiming authority to issue them
Zamora Yrala forged the certificates himself, on his own home computer. There was no hardware-backed, organisation-controlled signing step standing between “I want to issue a certificate” and a certificate existing. The paper format carried no cryptographic binding to an approved issuer at all, so a well-made forgery and a genuine document were visually indistinguishable.
This is exactly what regulators are now forcing manufacturers to close by moving to digital, cryptographically-bound release certificates. It is also the exact gap sitting inside most “proof of human” pitches on the table right now: nobody has said what stops a human signing an assertion about content they did not, in fact, produce.
Keyless signing schemes like Sigstore are a genuine partial answer here: they bind a signature to a federated identity token rather than a private key sitting on someone’s laptop. Worth noting, though, that this only solves custody. It says nothing about whether the identity behind that federated token was ever checked rigorously in the first place, which loops straight back to point one.
The action: never let the same actor control both the content and the attestation about it, without a hardware-backed or third-party checkpoint in between.
-
Assume revocation will be slow, and design for the damage that happens while it is
CFM’s own tally of forged documents grew for months after the fraud surfaced. 72 falsified certificates across 50 part numbers by the end of August 2023, rising to 92 falsified EASA forms covering 61 part numbers by October, with somewhere between 126 and 145 engines eventually confirmed to be carrying AOG-linked parts. Every one of those installations happened before anyone could revoke anything, because the only kill mechanism available was a manual, escalating chain of safety bulletins from the UK CAA, EASA and the FAA.
Between January 2019 and July 2023, more than 60,000 engine parts entered the global aviation supply chain carrying certificates that had never touched a genuine issuing authority.
PKI has that lag built in structurally, as a permanent design trade-off. A certificate revocation list or an OCSP responder is only as current as its last publish cycle, and plenty of clients cache the last good answer rather than check live on every connection. Nobody treats that as scandalous. It’s just the accepted cost of how revocation works, and content provenance is about to inherit the same cost with none of the decades of tooling built to manage it.
The action: build your provenance system on the assumption that a fraudulent credential will be used for months before revocation catches up, and size the blast radius accordingly.
-
The system only works if someone actually checks
Aviation’s model depended on buyers verifying a certificate directly with the named issuing organisation rather than trusting the paperwork at face value. Almost nobody did it, across a 4-year, 60,000-part supply chain, because access to the alerts and the ability to check existed the whole time. The fraud surfaced only because one maintenance shop, in Portugal, queried one component.
The same apathy is already baked into how most organisations consume C2PA manifests, SBOMs and code-signing certificates today. The tooling to verify exists. The discipline to run it on every artefact, every time, does not.
Plenty of pipelines mandate
cosign verifyor an equivalent for new services and quietly leave every legacy pipeline unverified, because retrofitting is expensive and nobody wants to be the one who breaks the release train chasing a theoretical risk. That’s not a hypothetical failing; it’s a completely normal trade-off teams make under delivery pressure, and it’s exactly the gap a forged credential walks through.The action: treat “verified” as something you check at the point of use, not something you assume because a badge is present.
-
A signature proves a moment, not a current state
An EASA Form 1 attests to a part’s condition and origin at the moment it was released. It says nothing about whether the specific piece of metal in an engineer’s hand today is still what the certificate describes.
This is the flaw sitting inside every “proof of human” concept on the table right now, will.i.am’s included. A signed assertion that a human touched something at creation time tells you nothing about whether the file in front of you, at this moment, is the same file: unedited, unregenerated, unlaundered through a second AI pass since the signature was made.
To be fair to C2PA specifically, it does handle one version of this well: the manifest hashes the bytes at signing time, so any edit to that exact file breaks the chain and shows up as tampering. What it doesn’t catch is the file being fed back through a generator, regenerated, and resubmitted as a fresh “human-signed” original. Nothing about the signature distinguishes a first-generation human file from a fifth-generation laundered one.
The action: treat any provenance claim as a statement about a point in time, and build the freshness check separately from the signature check.
-
The moment an attestation carries a price premium, forging it becomes the profitable move
Zamora Yrala’s fraud generated roughly £6.9 million over four years by undercutting genuine, certified parts while looking identical on paper. The fake only had to be cheaper than the real thing and hard enough to tell apart from it.
will.i.am’s stated goal for “proof of life” is explicitly economic: stop AI and human output being valued at the same fraction of a penny. That is the precondition for exactly the fraud aviation just spent four years cleaning up. Deezer alone was receiving close to 90,000 fully AI-generated tracks a day by mid-2026. The moment a “verified human” tag pays more than an unverified one, somebody runs that arithmetic at platform scale, and no format announced so far raises the cost of faking enrolment above the price of the premium it protects.
The stakes are no longer just commercial. The NO FAKES Act, cleared unanimously out of the US Senate Judiciary Committee in June 2026, carries platform liability of up to $750,000 per work. The EU AI Act’s Article 50 marking duty became enforceable on 2 August 2026. Both assume there is a working way to tell human from synthetic. Neither one specifies who checks the enrolment behind that determination. Watermarking at Google’s scale, over 100 billion images and videos marked by SynthID as of mid-2026, is a genuinely useful detection layer, but detecting AI output and verifying a human’s identity claim are two different problems, and only one of them has serious engineering attention right now.
The action: before pricing any provenance premium into a product, cost out how much cheaper it is to forge the credential than to earn it, at the volume your platform actually sees.
The only question that matters right now
Aviation didn’t solve provenance by inventing a better certificate. It solved it, imperfectly, by building an entire apparatus around the certificate: licensed issuers, traceable manufacturing, an inspector corps, mandatory reporting, and a legal duty on every buyer to check. That apparatus works, most of the time, for most parts. Even so, one man with a home computer got four years and 60,000 parts deep before anyone noticed.
Every “proof of human” concept currently being pitched, will.i.am’s included, is proposing the certificate without proposing any of the apparatus around it. No inspector corps. No mandatory verification duty. No traceability requirement. No answer to who checks the checker.
You already know how this ends if that apparatus never gets built, because you are probably the person who gets asked to bolt a “proof of human” badge onto a content pipeline sometime in the next 18 months. When that request lands, the question worth asking is who was allowed to enrol in the first place.
That’s where the fraud will live. It always does.
The extended Enrolment Ceiling maturity model, mapped against the EU AI Act Article 50 marking obligations that took effect in August 2026, is coming next at blog.ogunlana.net.
Bola Ogunlana is a Senior DevSecOps Engineer with 25+ years in cloud infrastructure, UK Government delivery, and financial services. He writes at blog.ogunlana.net.