Apple signs pixels at the camera sensor, then develops them inside Private Cloud Compute.

Reference Image is an opt-in capture mode on iPhone 18 Pro where the camera sensor gets its own cryptographic signing identity at manufacture and signs raw pixel data immediately, with the Secure Enclave signing anything originating outside the sensor and an Apple timestamp service bounding capture time. The signed digital negative uploads to Private Cloud Compute, which does demosaicing, tone mapping and compression in a verifiable environment, runs an authenticity confidence score, and signs the result with hybrid MLDSA87-RSA-3072-PSS-SHA512. Apple explicitly contrasts this with C2PA, which attaches provenance metadata after capture rather than protecting the pipeline from the sensor forward. 307 points on Hacker News.