Why authenticity may become the scarcest resource of the AI era#
June 2026
This article combines verified data with the author's analysis and arguments. Facts are attributed to their primary sources. Conclusions about trends, risks, and technological architectures are analytical interpretations, not established facts.
For years, we believed the greatest challenge of the internet was censorship. In 2026, we discovered there is an even bigger problem: distinguishing what is real from what was generated by machines.
Censorship has a face. You know when a platform removes your post. You see the notification, you feel the absence. But fabrication gives no warning. It takes your voice, your face, your reputation — and you only discover the damage after the fact.
This is the new digital battlefield. And most people have not yet realized the war has already begun.
The Collapse of Visual Evidence#
In March 2025, a finance director at a multinational firm in Singapore authorized a transfer of $499,000 during what appeared to be a video meeting with the company's senior leadership.
None of the people on screen were real.
The executives on that call — the CFO, the directors — were deepfakes generated in real time by artificial intelligence. He believed what he saw. He transferred the money. Only afterward did he discover he had been deceived by pixels and algorithms.
It was not an isolated case. British engineering firm Arup lost $25 million in a similar scheme in Hong Kong in early 2024. The technology that made those attacks possible has not stopped evolving since.
In 2025, global losses tied to deepfake fraud reached $1.1 billion — triple the previous year, according to research by Surfshark published in February 2026. The FBI recorded, for the first time in its nearly 25-year history of digital crime reports, a dedicated category for crimes with an AI component: 22,364 complaints, with confirmed losses of $893 million in the United States alone. Deloitte projects that AI-enabled fraud could cost the country $40 billion annually by 2027.
Those are the reported numbers. Digital fraud specialists observe that they likely represent only part of the problem — many incidents never reach official records.
The technology required for these attacks has become widely accessible. A voice can be cloned with 85% accuracy from just three seconds of public audio — according to research by McAfee widely cited across the cybersecurity sector. Every recorded conference, every interview, every podcast an executive has ever recorded is raw material for their digital double.
"Seeing is believing" is no longer a valid maxim. It is a vulnerability.
The End of an Era: A Picture Is No Longer Worth a Thousand Words#
For centuries, humanity built its epistemology — its way of knowing what is true — on sensory evidence. Photographs toppled governments. Videos convicted criminals. Audio recordings ended political careers.
All of that infrastructure of trust was built on one assumption: that capturing a moment was hard to fake.
Generative AI destroyed that assumption in less than three years.
We are not talking only about financial fraud. We are talking about something structural. A fake press release from a publicly listed company can crash stocks. Fabricated audio of a religious leader can ignite conflicts. A synthetic video of a politician can influence elections.
The problem is not technical. It is philosophical. We have lost the ability to trust evidence.
The Question That Will Define the Next Decade#
The debate about freedom of speech on the internet was always, at its core, a debate about who controls the channel. Centralized platforms amplify, filter, remove. The counter-argument has always been: "Let people speak."
But what if the problem is not silencing voices — but creating false ones?
The question has shifted from do you have the right to speak? to how do I know it was you who spoke?
This is a fundamental shift. And it has repositioned a fifty-year-old technology — cryptography — as essential infrastructure of reality, not just of security.
The Global Race for Digital Provenance#
The corporate sector noticed the problem. The response was fast and, in many respects, substantial.
In 2021, Adobe, Microsoft, the BBC, Intel, and Arm founded the Coalition for Content Provenance and Authenticity — the C2PA. The technical standard they developed works as a cryptographically signed origin label, embedded directly into media files.
When you photograph with a compatible device, it signs the file with a digital certificate that records: when it was captured, which device was used, what edits were made, whether AI was involved in its creation. That information travels with the file, wherever it goes.
By January 2026, the initiative reported more than 6,000 participating organizations among members, affiliates, and ecosystem participants, including Google, Meta, OpenAI, Sony, Amazon, and TikTok. The Samsung Galaxy S25 began integrating C2PA-compatible features for certain AI image functionalities — unedited photos do not receive the certificate. The NSA and CISA, in a joint advisory from January 2025, formally recommended its adoption by critical government infrastructure.
On paper, it is the perfect solution: a verifiable chain of custody that travels with the content, from the moment of creation to the final consumer.
In practice, there is a structural problem that enthusiasts of the standard rarely emphasize.
The Problem C2PA Does Not Solve#
In the current implementation of the C2PA ecosystem, practical trust depends on Certificate Authorities recognized by the verifiers in use. If a CA is not on the consortium's approved trust list, the content appears as "unknown origin." Certain commercial certificate providers compatible with the ecosystem charge around $289 per year. There is no widely adopted free and open equivalent.
The Nikon incident in 2025 illustrated how implementation failures can compromise the ecosystem: the Z6 III camera was launched with C2PA support, but a flaw in the multiple exposure mode — introduced by the manufacturer, not the standard — allowed external images, including AI-generated ones, to be processed and signed as if they were authentic captures from the camera. Nikon revoked the affected certificates and temporarily suspended the authentication program while working on a fix — invalidating, in the process, every provenance credential those cameras had produced up to that point.
There is also a deeper conceptual limitation: C2PA certifies the history of content, not its truth. A deepfake generated on a C2PA-compatible device would receive a valid signature — certifying, precisely, that it was created there, at that moment, with those tools. The chain of custody would be correct. The content, false.
And there is the philosophical question no one in the consortium answers directly: who decides which Certificate Authorities are trustworthy? Today, it is a consortium of private companies. The trust infrastructure, once again, is centralized.
C2PA may play an important role in building digital provenance infrastructure. But in isolation, it appears structurally insufficient as a sole solution.
Why Nostr Was Born Ready#
Nostr is not the only attempt to solve the problem of digital authenticity through decentralized means. W3C's Decentralized Identifier (DID) standards and Verifiable Credentials — adopted by projects such as Microsoft Entra and the Ethereum ecosystem — also seek to provide verifiable authorship mechanisms without depending on a single central authority. Blockchain-based systems propose immutable identity and content registries. Each approach involves distinct trade-offs in complexity, cost, and adoption.
What sets Nostr apart is integrating authentication directly into the social protocol, making authorship verification part of the system's basic architecture — not a feature added on top.
Nostr was not designed specifically to solve the deepfake problem. It was built to address the oldest and most fundamental challenge of digital communication: how to verify authorship without depending on any intermediary.
Nostr — Notes and Other Stuff Transmitted by Relays — is a decentralized communication protocol created in 2020 by Brazilian developer Fiatjaf. Its design is radically simple. And because it is simple, it is hard to break.
In Nostr, your identity is your cryptographic key pair. Your public key — the npub — is your public address, visible to everyone. Your private key — the nsec — is the mathematical proof that you are you, and does not need to be shared with any server or intermediary.
There is no registration. There is no central server. There is no account to be suspended.
NIP-01 — the foundational document of the protocol, equivalent to a technical constitution — defines that every publication on Nostr is a cryptographically signed event. Every note, every comment, every reaction carries the mathematical signature of the private key of whoever created it. Relays — lightweight servers that store and distribute events — cannot alter the content without invalidating the signature.
Any Nostr client, on any device, can verify locally whether an event is authentic, without consulting any central server, without asking permission from any company.
The keys use the secp256k1 elliptic curve — the same as Bitcoin. Not a coincidence: both were designed to operate without central authority, with mathematical verification open to anyone.
The Difference That Defines Everything#
Here is the contrast that matters:
C2PA asks: which entity certifies the provenance of this content?
Nostr asks: does the mathematics confirm that this private key signed this event?
In the first model, trust is delegated to an institution. If the institution fails, is compromised, or changes its policy, the trust disappears.
In the second, trust is verifiable by anyone with access to the open protocol. The absence of a central point significantly reduces single points of failure compared to models based on certificate authority.
With the elliptic curve cryptography used by Nostr, producing a valid event on behalf of a key without possessing the corresponding private key is computationally infeasible with current technology. This does not eliminate the risks of private key compromise — devices can be hacked, users can be deceived. But it removes something different: the need to trust any intermediary to verify authorship. Cryptographic authenticity is not an optional feature — it is a native property of the architecture.
Sovereign Identity: From Geek Luxury to Practical Necessity#
For years, "Sovereign Identity" — or Self-Sovereign Identity — sounded like an enthusiast's project, relevant only to those already convinced about privacy and decentralization.
The environment of 2026 has changed that calculation in concrete terms.
For an investigative journalist, having an immutable and verifiable record that an article came from you — and not from an AI imitating your style — can be the difference between maintaining credibility or seeing years of work destroyed by a disinformation campaign.
For an activist under an authoritarian regime, publishing with a key that is not tied to any controllable server is a matter of physical security, not just digital security.
For an executive with a public audience, any statement that does not carry a verifiable signature can be disputed as false. Or worse: any false statement can be presented as real, with no immediate mechanism for refutation.
Sovereign identity ceases to be a philosophical preference. It becomes practical protection.
The Coming War: Verification, Not Narrative#
The information wars of the last decade were wars of narrative. Whoever controls the framing controls the perception. Platforms were the battlefield. Algorithms were the weapons. Content moderation was the most heated political front of the digital era.
The next conflict will be different.
It will not be about which narrative prevails. It will be about which message can prove it is real.
When any video can be synthesized, any audio cloned, any text generated at industrial scale in any voice — the battle shifts. What matters is no longer the content. It is the certificate of origin.
And here is the risk few are discussing openly: whoever controls the verification infrastructure will control what the world considers true.
If that infrastructure is centralized — belonging to governments, platforms, or corporate consortia — we return to the original problem, only at a deeper level and one that is harder to contest. The censorship of the future may not remove your voice. It may simply deny verification of your signature.
Conclusion: The Key You Control#
The great irony of the generative AI era is that it makes cryptography — a fifty-year-old technology — more urgent than ever.
Not because cryptography is new. But because the problem it solves has finally become obvious to everyone.
The question "how do I know it was you?" has always existed. Humanity answered it with physical documents, witnesses, stamps, handwritten signatures — all based on the difficulty of faking the analog world.
The digital world fakes everything with industrial ease. The only adequate response to this level of fabrication is mathematics.
Your private key on Nostr is not a password. It is a sovereign identity. A proof that does not depend on appearance, voice, or style — it depends on a mathematical secret that only you possess.
The next generation will learn to ask questions that today still sound strange: does this news have a verifiable signature? Does this video have cryptographic provenance? Was this statement issued by the key I know?
Nostr was designed to answer those questions automatically through cryptographically verifiable signatures on every published event.
The rest of the world may take different paths. Corporate consortia like C2PA will evolve. Regulators will attempt to impose standards. Platforms will build their own verification systems. The need for verifiable mechanisms of authorship, however, seems increasingly inescapable.
Authorship authentication and content provenance do not need to be competing technologies. In many scenarios, mechanisms like C2PA and decentralized cryptographic signatures can complement each other — one certifying the chain of custody of the content, the other guaranteeing authorship without intermediaries.
The real question is not whether this future will arrive. It is who will control the infrastructure when it does.
And if you already have your key, that answer does not depend on anyone else.
Freedom of expression does not disappear in this scenario. It changes in nature. For decades we debated who could speak. Now we debate how to prove who spoke. The battle for authenticity does not replace the battle for freedom of expression — it joins it. A society unable to verify authorship risks losing both.
Source Notes#
The data cited in this article draws from the following primary sources:
- $499,000 / Singapore, March 2025: Joint advisory by the Singapore Police Force, Monetary Authority of Singapore, and Cyber Security Agency of Singapore, March 12, 2025; widely covered by international press.
- $25 million / Arup, Hong Kong: Official statement from Arup and coverage by the South China Morning Post, early 2024.
- $1.1 billion in deepfake fraud losses in 2025: Surfshark Research, published February 2026, based on the AI Incident Database.
- 22,364 complaints and $893 million: FBI Internet Crime Report 2025, published April 2026.
- $40 billion by 2027: Deloitte Center for Financial Services, "Deepfake banking and fraud risk on the rise," 2024.
- 85% accuracy from 3 seconds of audio: McAfee Research, "The Artificial Imposter" (2023), widely replicated and cited across the cybersecurity sector. UCL published a complementary study in April 2026 showing AI-cloned voices are up to 13.4% more intelligible than real human voices in noisy environments (Adank & Wang, Journal of the Acoustical Society of America, April 2026, DOI: 10.1121/10.0043094).
- More than 6,000 participating organizations in C2PA: Content Authenticity Initiative, January 2026. The number includes formal members, affiliates, and ecosystem participants — categories with different levels of engagement.
- $289/year for certificates: C2PA Viewer / SoftwareSeni, adoption analysis, April 2026.
- Nikon Z6 III incident: Discovery documented by researcher Horshack on the Nikon Rumors forum and DPReview (September 2025); confirmed by official Nikon communication to Nikon Imaging Cloud users; independent technical coverage by PetaPixel and Digital Camera World.