[gruez]

Doesn't IPFS use content-addressing? In other words, the url of a file is the hash, so the contents can't be changed.

[beaner]

Can it not be removed by the original uploader, or anyone else to acquire their credentials?

[heckerhut]

correct