It’s opt-in because your photo is sent to Apple’s servers. Only if it were on-device should they even consider making it default.
> i guess you need internet to take a picture
Not really, internet is required to process the reference image, but that can happen later if you’re not currently connected.
> are complex hardware attacks really that important?
No, but the floor shouldn’t be “trivially exploitable” like C2PA[0]. It’d be interesting if there were a middle ground but we don’t have anything like that as of now.
Ultimately though, i think all this might just mean we do not have a practical solution to this problem.
just to throw out some naive ideas, maybe the solution is to just sign the raw camera output and embed it in the metadata. If this is an optional feature meant for photojournalists, does file size really matter?