Not hot takes — build notes. What shipping licenses, cryptographic tools, and provenance systems actually taught me, written down before I forget the details.
Auditing C2PA against its own security goals: Falcon-1024 doesn't fit COSE, trust lists are policy gates in disguise, and detection will never substitute for proof.
Four versions of OPL in a year — what reciprocity got wrong, why "the license is the contract" beat registries and chains, and what maintainers actually need.
Shipping Ed25519 + Falcon-1024 without making users think about it: seed ergonomics, KDF choices, and post-quantum fallback that doesn't patronize.