Part of the series: Getting it organized properly. Notes from a field still finding its shape.

Capability in search of a reason

A capability does not become a standard because it is possible. It becomes a standard when enough independent parties have a reason to coordinate around it at the same time. Absent that reason, a capability can sit fully specified and technically sound for years, waiting not for better engineering but for someone who needs it enough to make the case for everyone else. EPUB's dormant signature mechanism is a useful case study of exactly that gap.

EPUB had a cryptographic signature mechanism before provenance became a mainstream concern. EPUB 3, released in 2011, included the Open Container Format's support for digital signatures through a file called META-INF/signatures.xml. The idea behind it is simple to picture. A creator hashes every file in the container, signs the set of digests with a private key and embeds the result in the container. A reader who wants to check a copy can verify the signature against a known public key and confirm that nothing has changed since it was signed.

Although the mechanism remains part of the specification, support for validating container signatures has seen little practical deployment in mainstream EPUB reading systems. What the mechanism lacked was a compelling reason for widespread adoption.

C2PA supplies a useful comparison, because it applies the same fundamental cryptographic pattern a decade later with a reason attached. Founded in 2021 by organizations including Adobe, Microsoft and the BBC, C2PA emerged in response to concerns around deepfakes and synthetic content. Its manifest format has since become an industry specification, attracting broad participation across technology, media and hardware, alongside ongoing work toward ISO standardization.

The underlying pattern is not new: hash the content, sign the hash and let any verifier check it independently. Camera makers, platforms and newsrooms adopted C2PA because deepfakes and synthetic media created a shared reason to coordinate.

The difference was not the cryptography. It was the role the standard played inside an ecosystem.

A standard is not just a technical specification. It is a coordination mechanism: a way for independent parties to agree that a capability matters now.

What C2PA had that EPUB's mechanism never developed was a shared reason that led many independent producers to coordinate at once.

A mechanism is not enough on its own

Key management tooling matured over the past ten years, cloud-based signing matured into a routine part of many software delivery pipelines. None of that was mature in 2011. None of it would have been sufficient on its own either.

A mechanism that is technically easier to use is still a mechanism waiting for the coordination that makes adoption possible.

Standards often need a sponsor before they need adoption. DRM had rights holders. Watermarking had distributors. C2PA had platforms, publishers and creators facing synthetic media. EPUB signatures had a mechanism but no broad constituency that needed everyone else to adopt it.

A reason that is starting to arrive

Publishing never had its own deepfake moment. It has instead had a slower drift, the kind that does not announce itself the way a single crisis does. Distribution systems may strip or rewrite metadata on ingestion. Copies circulate through channels the author never touched, sometimes with text altered along the way, often still carrying the original cover and title. A reader who downloads an EPUB from an unfamiliar source usually has no practical way to verify whether what they are looking at matches what the author actually released. None of this is new to 2026. It was just as true in 2011. What has changed is that more reading now happens through channels distant enough from the author that the question of whether a copy is faithful is worth asking at all.

That is a smaller and quieter reason than the one that produced C2PA and it does not require an industry coalition to act on it.

What the mechanism offers, once there is a reason to use it

It is worth being precise about what a signature actually proves. It proves that a specific key signed a specific file. It does not prove that a specific person is the author. Closing that second gap requires the reader to already know, through some trusted channel, which key belongs to which person, a problem PGP has never fully solved either. The signature is a claim about integrity from a known key forward, not a claim about identity from scratch.

A reason that does not require an industry

C2PA needed a coalition because it solved this problem for many independent producers at once. An individual author does not face that requirement and does not need to wait for publishing to find its own version of the deepfake moment. Consider an author who finishes a manuscript, runs it through a pipeline that produces an EPUB and signs the resulting container with a personal key, the same way many developers already sign software releases.

The trust problem does not disappear; it moves to key publication and discovery. But that is a narrower problem than establishing authenticity from an unsigned file. A reader who downloads a copy from any source, official or not, can check the signature against the author's known public key and know whether the text matches what the author actually released, all without asking permission from a publisher or a retailer.

The mechanism has waited in the EPUB specification since 2011. It was never short of engineering. It was only ever short of someone with a reason to use it. That reason no longer needs to arrive as an industry crisis. It can arrive one author at a time. The same pattern likely exists elsewhere: capabilities fully built into specifications, waiting for the problem that makes them matter.

Organizing this is harder than naming it. The work is collective and slow. The field gets organized by many people writing carefully about what they can see clearly. This article is one small contribution to that work.

Sources cited

• W3C. (2023). EPUB 3.3. EPUB Open Container Format (OCF) specification, including META-INF/signatures.xml.
• Coalition for Content Provenance and Authenticity (C2PA). C2PA Technical Specification. Manifest format and content provenance specification.
• Coalition for Content Provenance and Authenticity (C2PA). About C2PA. Founding members, mission and ecosystem overview.
• ISO. ISO/IEC 22144 (C2PA). Public information on the standardization of the C2PA specification.