If a signed sha256 is somehow attached in the exif data, it can be removed. What digital rights are there to manage? This would be a statement of authenticity,

If a signed sha256 is somehow attached in the exif data, it can be removed. What digital rights are there to manage? This would be a statement of authenticity, not proliferation control. The vendor's private key would have to be stored in the device. How could it be protected from extraction?