Nikon Z6 III: What the Certificate Revocation Teaches About AL2

Definition: The Nikon Z6 III revocation was the September 2025 withdrawal of all signing certificates for the camera after a researcher showed its multiple-exposure mode could be tricked into signing AI-generated frames.

TL;DR: The signatures verified and the manifests were well-formed. The flaw was upstream: a capture mode let attacker-controlled imagery be signed as authentic. That is an integration failure, not a crypto failure, and it is exactly the gap that hardware-attested AL2 signing is meant to close.

What happened

Researcher Adam Horshack demonstrated that the Z6 III's multiple-exposure overlay could be used to get the camera to sign AI-generated imagery as if it were captured. Nikon revoked every certificate on 21 September 2025. Existing manifests with valid timestamps remained verifiable; new trust in the pipeline did not.

Crypto was not the problem

Every layer of the signature worked. The hash matched, the signature validated, the timestamp was sound. The standard did its job. The failure was that the thing being signed was not what the manifest implied, because the capture path accepted manipulated input. A perfect signature on a compromised input is still a compromised result.

Where AL2 comes in

C2PA assurance levels grade key protection. AL1 protects the signing key in a hardened module, which Nikon had. AL2 adds device-level attestation that binds the key to a specific device and proves the hardware context, narrowing the gap where fake input reaches a trusted signer. The Pixel 10 reached AL2 in September 2025.

The lesson for builders

Match assurance level to threat. For server-side marking of generated content, AL1 is correct and capture attestation is irrelevant. For court-grade capture, AL2 matters, and the integration around the key matters as much as the key itself. The Z6 III is the cautionary tale that signing infrastructure is only as trustworthy as its weakest input path.

The incident behind this

Nikon Z6 III C2PA suspension, with all certificates revoked 21 September 2025, after a multiple-exposure overlay vulnerability disclosed by researcher Adam Horshack.

FAQ

Did the revocation break old photos?

No. Manifests with valid RFC 3161 timestamps stayed verifiable, because the timestamp proves validity at signing time regardless of later revocation.

Where Original Pictures stands today

Original Pictures offers a Sign API, a Verify API, hosted verify pages and the <op-verify> embed, the AI disclosure SDK with a tamper-evident evidence log, workflow templates, and the SDKs that wrap the APIs (the embed, the disclosure SDK and the SDKs are not yet published to npm or PyPI). One POST /v1/sign with "watermark": true, "fingerprint": true attaches a C2PA-format manifest and an invisible watermark and keeps a content fingerprint for lookup. RFC 3161 timestamping is built and will be switched on with our production signing certificate; files signed before then carry no trusted timestamp. Any C2PA-aware validator can read the manifest without calling us.

Original Pictures is C2PA conformant: it is listed on the C2PA Conforming Products List as a generator product under the C2PA Conformance Program 0.2 (C2PA Technical Specification 2.4), and any C2PA-aware validator can read its manifests. Signed with our production certificate from SSL.com, on the C2PA Trust List; validators that use the C2PA Trust List show the signer as recognized. One thing is on the near roadmap, and we name it as roadmap, not as shipped: a consumer capture app (not yet available). We do not sell a capture SDK.

Bottom line: The Z6 III proves signatures are not enough; the capture path must be trustworthy too. Use AL1 for server-side marking and AL2 for high-stakes capture, and treat the integration as part of the threat model.