Nikon Z6 III: What the Certificate Revocation Teaches About AL2
· Mahdi Kazempour, Founder, Original Pictures
Definition: The Nikon Z6 III revocation was the September 2025 withdrawal of all signing certificates for the camera after a researcher showed its multiple-exposure mode could be tricked into signing AI-generated frames.
TL;DR: The signatures verified and the manifests were well-formed. The flaw was upstream: a capture mode let attacker-controlled imagery be signed as authentic. That is an integration failure, not a crypto failure, and it is exactly the gap that hardware-attested AL2 signing is meant to close.
What happened
Researcher Adam Horshack demonstrated that the Z6 III's multiple-exposure overlay could be used to get the camera to sign AI-generated imagery as if it were captured. Nikon revoked every certificate on 21 September 2025. Existing manifests with valid timestamps remained verifiable; new trust in the pipeline did not.
Crypto was not the problem
Every layer of the signature worked. The hash matched, the signature validated, the timestamp was sound. The standard did its job. The failure was that the thing being signed was not what the manifest implied, because the capture path accepted manipulated input. A perfect signature on a compromised input is still a compromised result.
Where AL2 comes in
C2PA assurance levels grade key protection. AL1 protects the signing key in a hardened module, which Nikon had. AL2 adds device-level attestation that binds the key to a specific device and proves the hardware context, narrowing the gap where fake input reaches a trusted signer. The Pixel 10 reached AL2 in September 2025.
The lesson for builders
Match assurance level to threat. For server-side marking of generated content, AL1 is correct and capture attestation is irrelevant. For court-grade capture, AL2 matters, and the integration around the key matters as much as the key itself. The Z6 III is the cautionary tale that signing infrastructure is only as trustworthy as its weakest input path.
The incident behind this
Nikon Z6 III C2PA suspension, with all certificates revoked 21 September 2025, after a multiple-exposure overlay vulnerability disclosed by researcher Adam Horshack.
FAQ
Did the revocation break old photos?
No. Manifests with valid RFC 3161 timestamps stayed verifiable, because the timestamp proves validity at signing time regardless of later revocation.
Where Original Pictures stands today
Original Pictures ships three things today: a Sign API, a Verify API, and the SDKs that wrap them. One POST /v1/sign attaches a C2PA-format manifest, an invisible TrustMark watermark, and an OpenTimestamps anchor. The open-source verifier checks any of it without calling us.
Two things are on the near roadmap, and we name them as roadmap, not as shipped: C2PA Conformance Program recognition (target Q3 2026, until then our manifests use the published C2PA v2.2 format and any C2PA-aware validator can read them, but third-party validators will show our signer as not-yet-listed), and a consumer capture app (Q3 2026). We do not sell a capture SDK, and we do not claim Trust-List membership we do not yet hold.
Bottom line: The Z6 III proves signatures are not enough; the capture path must be trustworthy too. Use AL1 for server-side marking and AL2 for high-stakes capture, and treat the integration as part of the threat model.
Related
Original Pictures is progressing through the C2PA Conformance Program; our signing certificate is not yet on the official C2PA Trust List. Target: Q3 2026. We will not describe ourselves as "C2PA-certified" until it is true.
Original Pictures provides content-provenance infrastructure. It does not by itself constitute legal compliance with the EU AI Act or any other regime; compliance depends on how you deploy it, your disclosures, and your governance. Figures are drawn from public reporting, verify against primary sources before citing in regulated materials. Nothing here is legal advice.
Last verified 2026-05-25. Author: Mahdi Kazempour, Founder, Original Pictures.