Claude started signing its sentences. We have been signing our builds for years.

When we write about code signing, the point we keep returning to is that a signature does not tell you software is safe. It tells you which named legal entity is accountable for it. That is a smaller claim than people assume, and a far more useful one.

In August 2026 the AI industry started making the same kind of claim about text. A watermark in Claude's output does not tell you the text is true, or good, or written without a person's involvement. It tells you it came through a particular model. Same shape of statement. Same category of proof.

Software distribution worked through the consequences of that shape over roughly twenty years, and most of them were painful. It seems worth writing them down while the second industry is still early.

One: provenance is not quality, and people will confuse them anyway

A signed installer can contain malware. This is not hypothetical; signed malware is a recurring category. The signature never claimed otherwise, but users read a publisher name and relax, because a name where a warning used to be feels like an endorsement.

Expect exactly this with watermarks. Text without a mark will be read as human, and human will be read as trustworthy. Both steps are wrong and both will happen constantly.

Two: reputation attaches to the identity, not to the artefact

Trust does not accumulate on an application. It accumulates on the certificate identity that signed it. Change the registered entity and the record does not follow you; you start from nothing. This is why the name on the certificate has to be the name on the incorporation certificate, permanently.

The watermark equivalent is already visible. The mark identifies a model family and a key, not an author. Whatever reputation accrues, accrues there. A company publishing marked text is borrowing someone else's provenance, and has no way to attach its own accountability to the same signal.

Three: the key is the entire system

Since June 2023, industry rules have required code-signing private keys to be held in validated hardware rather than as a file on a build machine. That rule exists because the common way signing identity gets stolen is not a clever attack on a certificate authority. It is a key sitting somewhere more people could reach than anyone remembered.

Every provenance system eventually reduces to a question about key custody.

Watermark detection depends on holding a key too. Who holds it, who may ask it a question, whether an answer can be bought, subpoenaed or faked. Those are the same questions, arriving in a new industry that has not yet had its first bad incident. Anthropic has said the detection API is coming and the details are still being decided. Those details are not a footnote. They are the product.

Four: two chains, doing different jobs

Signing an installer covers the moment a user first runs it. It does nothing for the update that arrives three weeks later. So we run a second verification chain for updates, deliberately not dependent on the first, because the failure modes differ.

Marked AI text needs the same separation and does not have it. The mark says a model produced the words. It says nothing about who commissioned them, who edited them, or who published them, and it cannot distinguish text Claude wrote from text Claude heavily edited. Anyone building a policy on top of the mark alone is building on one chain and hoping.

What we would tell the AI industry, briefly

Publish the limits louder than the capability. Assume the tool will be used to accuse people and design against that first. Decide key custody in public before anyone depends on the answer. And keep saying, until it is boring, that provenance is a statement about origin and never a statement about worth.

We are a small company and nobody asked us. But we have carried a signing identity long enough to know which parts hurt later.