I can make something and produce a digital signature for it. AI can't fake the signature. We meet in real life and exchange keys. You pass my key to your browser so when it encounters content with my signature it marks it as having come from somebody whose humanity you have verified. We build a network of such relationships. Maybe it's enough to just see an annotation, a sort of glow around the content that has verified human signatures. Or maybe we go full dark-forest and configure the browsers to only render content that has a trusted signature.
[bell ring] What is PGP?
[dead]
The problem is that the majority of the time, the one ultimately trying to dupe you is not the AI model, but the person who handles it.
In other words, signatures don't address the fact that a human can ask an AI model for content and then sign it to pass it as their own.