Before the fog lifted: a verified walk up Fløyen

Photos & video: Nathanial Freitas Captured with Proofmode Google Pixel 9 Re-checked 24 Sep 2026 · c2patool 0.27.22 CC0

A little after eight on a grey Tuesday morning, a small group gathered on the cobbles outside the white station house of the Fløibanen funicular in central Bergen. Rather than ride up, some of them walked. Over the next seventy minutes the phone in one walker’s pocket recorded seven photographs and two short videos as the path climbed roughly 300 metres, through spruce and birch, to the viewpoint at the top of Mount Fløyen.

What makes these images unusual is not what they show but what travels with them. Each file was captured with Proofmode, which seals the picture together with a signed record of where, when and on what device it was made. That record is not hidden. Anyone can open it, the same way a web browser lets you view the source of a page, and anyone can check it without trusting us, the photographer or the app.

So we did. For every stop on the climb we read the raw, signed manifest embedded in the file and the checks it passed, and we laid out everything that happened to the file, second by second, from the shutter to its notarisation on public ledgers.

You can do the same. Under each photograph below, Verify proof opens the original, full-resolution file from the Filebase IPFS network in Proofmode’s browser-based checker, with its Content Credentials intact.

The climb, stop by stop

08:01 · The bottom of the hill

Cobbled lane rising to the white Fløibanen funicular station house, flags on poles, a few people by the entrance. — The cobbled approach to the Fløibanen lower station, central Bergen. Verify proof

The first frame of the morning is the most ordinary: wet cobbles, slack flags and the white station house at the head of the lane. The phone put itself at 59 metres above sea level, within about 14 metres horizontally.

It is also one of only two files in the set to carry a second, organisational identity signature, which vouches for the creator’s name, the CC0 licence and a request that the image not be used to train AI models.

08:03 · The group gathers

A group of around twenty people in rain jackets standing in front of the arched entrance of the Fløibanen station. — Walkers assemble beneath the station's arched entrance. Verify proof

Two minutes later the group has formed under the arch. The signed location moved by less than four metres between the two shots, which is what you would expect from someone standing still on the square.

Its Content Credentials validate as trusted, and like the first photo it carries the organisational creator signature.

08:05 · The photographer checks in

Selfie of a man in a flat cap with a grey goatee, the Fløibanen station entrance and the waiting group behind him. — Nathanial Freitas at the station entrance before setting off. Verify proof

The only self-portrait at the bottom of the hill. Its credentials are trusted and intact, but this is the one file whose Nostr announcement never landed: the event was signed correctly, and all three relays turned it away. Its other public trails, OpenTimestamps and IPFS identifiers, were produced as normal.

08:31 · Into the trees

08:31 CEST

60.3955° N, 5.3378° E · 225 m

Google Pixel 9

Content Credentials

Trusted

Twelve seconds on the gravel road through the spruce.

Half an hour in, the path has left the town behind. This twelve-second clip was recorded at 225 metres, about 166 metres above the start.

For video, Proofmode seals the content with a BMFF hash covering the whole MP4 structure, and it validates as trusted. This is also the only file whose location attestation reached a blockchain, recorded on Ethereum’s Sepolia test network at 08:32.

08:34 · The clip without a certificate

08:34 CEST

Location

None

Google Pixel 9

Content Credentials

None

A minute of conversation beside the funicular line.

Three minutes later, a longer clip beside the funicular track. It looks like the others, and its hash and OpenPGP signature are intact. But it is the one file in the set with no Content Credentials embedded and no location fix in its proof record, and it was not notarised on Nostr or OpenTimestamps.

That does not make it fake. It means a viewer has to take its place and time on trust, which is exactly the gap Content Credentials are designed to close. We have placed it on the climb by time alone.

08:56 · Above the treeline, briefly

A tall slender mast topped by a long single blade rises into a white sky above spruce trees, a walker with a backpack in the foreground. — A tall mast with a single blade, at 328 metres. Verify proof

At 328 metres the path passes a tall mast crowned by a long single vane. The location fix here is the loosest of the morning, with a reported accuracy of about 31 metres, a reminder that network positioning degrades on a forested slope.

09:08 · The top

Selfie of the same man in a flat cap with Bergen's harbour, a docked cruise ship and the fjord below, walkers on the viewing terrace. — At the Fløyen viewpoint, with the harbour and fjord behind. Verify proof

At 09:08, sixty-seven minutes after the first frame, the phone reports 361 metres: a climb of about 300 metres over some 830 metres of straight-line distance. Below, a cruise ship is tied up in the harbour.

Every altitude after this reads the same 361.1 metres, the kind of plateau that suggests the phone was repeating its last reliable height rather than measuring afresh.

09:10 · How far from anywhere

A black signpost on the Fløyen terrace pointing to distant cities, the city spread out below. — The signpost on the Fløyen terrace. Verify proof

The famous signpost counts distances to far-off cities. Two minutes after the selfie, the signed position sits within a few metres of it.

09:10 · The view down

Wide view from Fløyen over Bergen, the harbour and the fjord to distant hills, with the signpost at left. — Bergen and the fjord from the viewpoint. Verify proof

The last frame of the walk, eight seconds after the previous one, pulls back to take in the whole city. Its Nostr notice reached two relays, and like every photograph here it records a single action, c2pa.created: it has not been edited since the shutter.

What we checked, and how

8 of 9

files carry Content Credentials that validate as Trusted

9 of 9

SHA-256 hashes and OpenPGP signatures intact

7 of 7

photographs unedited since the shutter

We re-validated every file from scratch rather than relying on Proofmode’s own verdict. The Content Credentials in each photograph and in the first video were read with the open-source c2patool from the Content Authenticity Initiative, configured to trust only the certificate authorities on the official C2PA conformance trust list and its companion list of approved timestamp authorities.

Proofmode’s signing certificate, issued to “Proofmode for Android” at Proofmode Reality Systems LLC, is not itself on that list. It is issued by the Trufo C2PA Claim Signing CA, whose root, the Trufo C2PA Root CA, is. That chain is what turns a merely valid signature into a trusted one. Every signature was also countersigned at the moment of capture by an SSL.com C2PA timestamping unit that chains to a root on the C2PA timestamp list, so the signing time does not depend on the phone’s clock.

Beyond the embedded credentials, Proofmode wrote a set of sidecar files for each capture. We recomputed every SHA-256 hash, checked every OpenPGP signature against the key shipped in the archive, and verified each Nostr notarisation’s event ID and Schnorr signature.

“Trusted” is c2patool’s highest validation state: the signature, content hash and every assertion check out, and the certificate chains to an anchor we supplied. Nostr figures are relays that accepted the event, out of three attempted.

Whose name is on the creator signature?

Content Credentials can carry a second, separate signature from the Creator Assertions Working Group (CAWG) that binds a person or organisation to the work. We expected to find one made with a personal certificate belonging to Nathanial Freitas. We did not.

Two files, the 08:01 and 08:03 photographs outside the funicular station, carry a CAWG identity signature. In both, the signing certificate belongs to the organisation Proofmode Reality Systems LLC, issued by the Trufo Interim CAWG Identity CA and chaining to the Trufo C2PA Root CA. It vouches for the creator metadata naming Nathanial Freitas, the CC0 licence and the “do not train” AI preferences. It is an organisational attestation, not a personal one.

That distinction matters for trust. Checked against the Mozilla root store alone, which is where a personal SSL.com certificate would be anchored, both CAWG signatures come back signingCredential.untrusted. They become trusted only once the Trufo root is also admitted as a CAWG anchor. No SSL.com certificate appears in either chain.

The other six credentialed files name Nathanial Freitas as creator in a cawg.metadata assertion but carry no CAWG identity signature at all. The name is protected from tampering by Proofmode’s claim signature, but it is the app’s statement, not an independently certified identity.

What the files cannot tell you

Provenance data proves that a file has not changed since it was signed and records what the device reported at the time. It does not prove that what the device reported was true, and it has gaps a careful reader should know about.

One video has no credentials

The minute-long clip beside the funicular track, timed at 08:34, has no C2PA manifest embedded, and its sidecar records no location fix. Its SHA-256 hash and OpenPGP signature are intact, so it has not been altered since Proofmode processed it, but nothing ties it to a certified signer, a trusted timestamp or a place. No OpenTimestamps or Nostr notarisation was produced for it either.

Location comes from the network

Every fix was made by the phone’s network location provider, with a reported horizontal accuracy of 11 to 31 metres. The altitudes are reported to a tenth of a metre, but no vertical accuracy is recorded and the readings step in plateaus, so treat them as approximate. The C2PA metadata does record that the locations were not mocked.

Two clocks, one label

In the sidecar files the “File Created” field reads, for example, 08:01:23Z. The Z suffix normally means UTC, but the value is actually Bergen local time; the embedded GPS time, the C2PA signature and the SSL.com timestamp all place the first photo at 06:01 UTC. Nothing is wrong with the evidence, but a reader converting that field naively would be two hours off.

Some notarisations are still in flight

All eight OpenTimestamps proofs in the archive are calendar commitments that have not yet been upgraded to a confirmed Bitcoin block, and the Nostr notice for the 08:05 selfie was not accepted by any relay. Location attestations were signed for four files using the Ethereum Attestation Service; only the 08:31 video’s reached a chain, and that chain is the Sepolia test network.

The sidecars are revealing

Proofmode’s proof files also record the phone’s IP addresses, nearby cell towers and a device identifier. For a hiking trip that is a matter of courtesy; for a human rights documenter it can be a matter of safety, and it is worth deciding before sharing a Proofmode archive what it should contain.

Check it yourself

Every result in this post can be reproduced with open tools. With the original proof pack downloaded and unzipped:

# C2PA trust lists (claim signers and timestamp authorities)
curl -LO https://raw.githubusercontent.com/c2pa-org/conformance-public/main/trust-list/C2PA-TRUST-LIST.pem
curl -LO https://raw.githubusercontent.com/c2pa-org/conformance-public/main/trust-list/C2PA-TSA-TRUST-LIST.pem

# Validate with trust on (settings.json lists the PEMs above as
# trust.trust_anchors, and Mozilla roots + Trufo as cawg_trust.trust_anchors)
c2patool --settings settings.json 1790056879369.jpg

# Hashes and OpenPGP signatures
sha256sum 1790056879369.jpg
gpg --import pubkey.asc
gpg --verify a856d1c2…709312.asc 1790056879369.jpg
gpg --verify a856d1c2…709312.proof.json.asc a856d1c2…709312.proof.json

# Bitcoin notarisation, once the calendars have anchored it
ots upgrade a856d1c2…709312.ots && ots verify a856d1c2…709312.ots

Images and video in this post are resized copies made for the web, so they no longer carry the original signatures. The originals, with their manifests intact, are the evidence. The photographs are released by their creator under CC0.

Get the proof pack

Download the complete proof pack for the walk: the original photographs and videos with their Content Credentials intact, plus every sidecar file, signature and notarisation. Check it by hand with the commands above, or load it into ProofCheck to verify and inspect it in your browser without installing anything.

Download the proof pack Open ProofCheck

OpenPGP key E179 6DD4 6656 43FC 79A8 4B40 0019 8C6A 2877 6490