For publishers
Your investigation goes live at 10:14 AM. By 2:00 PM, four AI farms have cloned it with subtle word changes, attributed it to fake bylines, and posted it on similar-looking domains. Search engines index all of them. Your original blurs into the noise. Your reputation gets laundered into someone else's traffic.
AgentPKI Provenance is how you sign your work at publication time, and how anyone — reader, search engine, archive, court — can prove which is the original in milliseconds.
Sarah Lin is a freelance investigative writer with 18,000 Substack subscribers. Her piece on a healthcare-billing scam takes six weeks to research and one hour to write up. Here's what happens after she clicks publish — without AgentPKI, then with it.
Today — without provenance
The original loses to clones because nothing distinguishes them. Sarah's brand becomes provably unprovable.
With AgentPKI Provenance
The original wins because the original is the only one anyone can verify. Sarah's brand stays Sarah's.
Sarah is a composite — but every step in the "today" column is happening to investigative journalists, Substack writers, photographers, and independent researchers in 2026.
AgentPKI Provenance is a thin extension of C2PA, the Adobe/Microsoft/BBC content credentials standard. Existing C2PA tooling (Adobe Content Credentials, Truepic Lens) sees signed content and treats it normally. AgentPKI tooling adds the agent-attribution layer.
Substack, Reuters, Wikipedia, or you-as-a-self-publisher generate an Ed25519 keypair and register a tier-2 issuer at dashboard.agentpki.dev. One-time setup.
Your CMS adds one API call before publish. The article's bytes are hashed (SHA-256), the hash is bound to your passport, the signature is attached as a sidecar JSON, an HTTP header, or an inline comment.
Readers, search engines, browser extensions, court records all hit a stateless verifier (provenance.agentpki.dev, or any verifier — open spec, no lock-in). They get back: "yes, Substack-authored at 10:14 AM, sha256 matches."
Hands-on
Paste any text into the Provenance Explorer. We mint a publisher passport, sign your content, give you back a manifest and HTTP header. Then we let you tamper with the content and watch verification fail. Same code that will run when Substack deploys this.
We're talking to publishers who would deploy AgentPKI Provenance as a reference integration — and become the case study every other publisher reads when deciding whether to adopt. We bring the protocol, the verifier, and the engineering integration support; you bring the editorial credibility.
