The problem in the field

Footage gets challenged. I watched it happen for two decades, and the challenge is rarely about what the video shows. It's about whether that file is the file the camera made. The chain of custody for a clip today rests on people and paperwork: who exported it, from which server, and whether anyone believes them. A hash taken at export proves the file hasn't changed since export. It says nothing about the hours before.

Why the usual answers fail

Watermarks are cosmetic. Server-side signing ties trust to the VMS vendor's key, so you're trusting the same system whose export you were questioning. Proprietary evidence formats lock the proof to one player. And most schemes sign the rendered video, which is the wrong object when an analytic fired on a frame and the frame is what matters.

What I built

AXIS cameras sign the video at the edge, and EdgeProof checks those signatures against Axis's public certificates. It builds on the MIT-licensed signed video framework, and ONVIF Media Signing v25.12 is the cross-vendor path for H.264 and H.265. Audio is out of scope. The core primitive is the Signed Detection Record: about 400 to 500 bytes of CBOR plus a detached COSE_Sign1 signature over ECDSA P-256, signed per detection. For now that record is signed with a software key on a computer, not in the camera.

Signed Detection Record v1   about 400–500 B · CBOR + COSE_Sign1 (ES256)
  id                 record id
  ts / ts_mono       UTC timestamp and monotonic counter
  cam                camera, as "vendor:id"
  fw                 firmware version
  analytic           id + version of what fired
  src_frame_sha256   hash of the source frame, not a render
  det                class · confidence · box · optional track
  sig                detached, ECDSA P-256
  trust_tier         absent by design · the verifier decides

How it works

One record, two envelopes. A standalone CBOR/COSE file that outlives the video, so the proof survives even when the footage is purged. An ONVIF SEI tag carried inside the stream, for when the video is retained, is planned and not built. Trust is a ladder that the verifier climbs, and the record never claims its own rung. Tier 0 is a software key. Tier 2 is a per-camera key attested by the manufacturer, which is the ship target and depends on vendors implementing it. Tier 3, a factory-burned key, is probably out of reach.

When the video is degraded, not deleted

Retention rules say keep ninety days. Storage budgets say you can't keep ninety days at full rate, so the archive transcodes it, cuts it to event clips, or thins it to keyframes somewhere around day fifteen. The camera's signature covered the original bytes. After the first transcode it covers nothing, and a sixty-day-old clip walks into a hearing with no proof at all. The fix is not to sign the copy again with the archive's key and call it authentic. It's a second small record, emitted by whatever did the transform, that says what it read, what it wrote, and how. This part is designed, not built: its wire format is still in review.

Derivation Record   draft · CBOR + COSE_Sign1 (ES256) · signed by the archive, never the camera
  cam            the source camera, carried forward on every hop
  src.sha256     hash of the bytes it read
  src.proof      hash of the source's retained signatures, if kept
  src.prev       the previous hop, when this is not the first
  out_sha256     hash of the bytes it wrote
  transform      transcode · clip · keyframes · downsample
  policy         the retention rule that triggered it · displayed, never judged
  rung           absent by design · the verifier walks the chain and reports how far it reached

The verifier's answer will be graded, and it will say so. Attested means the archive's key vouches for the transform and nothing more. Chained means every hop links back to a first source. Camera-linked means the first hop kept the camera's signature set alongside the derivative, and the retained keyframes still check against it. Two keys, two answers: a plain software key on the archive job can still produce a camera-linked copy of a manufacturer-attested stream, and the certificate says exactly that. What the record refuses to do is judge the policy. Whether one frame every five seconds satisfies a state's retention statute is a legal question about the rule, not a property of the bytes.

Where it stands

The record format is built and tested: edgeproof-sdr v0.1.0 was tagged on July 4, 2026 after review, and v0.2.0 the next day added health, efficacy and attention records. Neither is published, and both repositories are private for now. A web verifier is in development and is not open to anyone. Nothing has been used in the field yet. A software key proves the record wasn't altered after signing; it does not yet prove the record came from that camera. That is the Tier 2 gap, and it is a vendor gap as much as mine.

What's next

Finish the web verifier and test it on real clips, then pilots with agencies that have a reason to care. The benchmark I've set: a 500-clip test set with zero false confirmations. A verifier that ever says yes to a doctored clip is worse than no verifier at all.