The proof itself relies on asymmetric crypto, and that part is not tenuous (well, until Q Day, but that's a different story...). But: - You cannot prove that

The proof itself relies on asymmetric crypto, and that part is not tenuous (well, until Q Day, but that's a different story...). But: - You cannot prove that no one has ever been able to break a Secure Enclave or a YubiKey or another secure element. That's okay, these companies focus on making it so expensive that it's not worth doing. - The analog "attack vector" is real, but that was always true with analog cameras as well. Anyone could have taken an analog picture of a screen, or even painted a hyper realistic image of something that never happened. I think a realistic goal for provenance is to at least get to parity with analog cameras ("this is a picture directly from a sensor"), not to make the perfect system for proving that a photo is of a real world event.