I am not sure I follow. The private keys in the image sensor and the SEP are static, so you can see that two images are signed with the same private key. Apple

I am not sure I follow. The private keys in the image sensor and the SEP are static, so you can see that two images are signed with the same private key. Apple 'decorrelates' this by letting PCC verify the signature and then replacing it by their own signature: When the user initiates developing a reference image, the device uploads the secure digital negative to Private Cloud Compute. PCC recomputes the digest embedded in the frame and verifies the sensor's signature over the pixels and that digest, verifying the certificate chain back to the sensor CA. PCC also verifies the SEP signature and chains it to the BAA CA, and it verifies the signature on the device manifest and chains it to the CA that signs device manifests at the factory. It then confirms that the sensor and SEP named in those chains belong to the same device. [...] If these checks pass, PCC then submits the commitment to our signing service, which signs it with a composite post-quantum signature using a hybrid MLDSA87-RSA-3072-PSS-SHA512 scheme. The signature is embedded in the JPEG, and the reference image is returned to the device, which associates it with the main photo from the original capture. After the secure digital negative is successfully developed, it's automatically moved to the deleted photos folder." So in the end it all depends on how much you trust Apple's cloud and PCC nodes. If there is a weakness in their services, Apple could record both the original signatures and their signature, and could prove whether two photos were made using the same lens/device and they could even trace it back to a specific device (by looking up the original signature + signing identity given their signature).