Provenance Can Be Unlinkable

Hypothesis: capture credentials can remain verifiable without becoming globally linkable. Test rotating certificates and selective disclosure against realistic adversaries, measuring privacy, revocation, abuse reporting, and newsroom usability. If unrelated assets can still be joined to one identity, the provenance layer has quietly become a tracking system.