Build with Trusteddit PKI
Add verified content credentials to your app
Trusteddit provides C2PA content credential signing as a service. Your app generates cryptographic keys on-device, enrolls for a short-lived certificate, and signs all captured media with verifiable provenance before it ever leaves the device.
How It Works
Trusteddit sits between your app and the C2PA Trust List
Generates keys on-device. Signs media with device certificate.
Issues short-lived certificates (90-day) to enrolled app installs. Chains to the C2PA Trust List via Trusteddit-Journalist-Issuer-CA.
Verifying applications (browsers, social platforms, news readers) resolve the certificate chain and display a provenance badge to the viewer.
What Trusteddit Provides
Trusteddit operates as a C2PA-focused intermediate certificate authority. Rather than issuing a single certificate per journalist or organisation, Trusteddit issues a per-install certificate to every enrolled app instance. This means the signing key never leaves the device.
Privacy is preserved through opaque signer IDs. The certificate common name is an HMAC-derived token in the format ph_<hash>@thephenom.app that cannot be reversed to a real user identity by any external party. Only your app backend holds the mapping. This design is GDPR-compliant by construction.
When a piece of media is uploaded, your backend verifies the C2PA manifest attached by the device, then calls the Trusteddit badge-signer API to issue a second signature: a verification badge proving that your platform reviewed and authenticated the content. Verifying applications display both signatures to the viewer.
Integration Guides
Glossary
Key cryptographic, provenance, and standards terminology used across the Trusteddit developer documentation.
Open technical standard for certifying the source and history of digital media content.
Tamper-evident metadata attached to digital media indicating provenance and edits.
Framework of roles, policies, and hardware/software to create, manage, and revoke digital certificates.
Trusted entity that issues cryptographically signed digital certificates.
Standardized message sent from an applicant to a CA to apply for a digital identity certificate.
Standard format for public key certificates used in TLS, code signing, and C2PA manifests.
Elliptic curve cryptography algorithm providing strong signing security with compact keys.
Keyed-hash message authentication code used for secure token generation and verification.
Compact, URL-safe means of representing claims securely between two parties.
Structured metadata box containing cryptographic assertions and signing provenance.
Curated registry of authorized certificate authorities recognized by C2PA verifiers.
Third-party service providing RFC 3161 proof that a signature existed at a specific time.
Verifiable custody chain and editing history of a digital asset from capture to publication.
European Union regulation on data protection and privacy within the EU and EEA.
Trusteddit, a service of SanMarcSoft LLC