[loudmax]

You're right, hardware keys will leak. The idea is not to put trust into hardware, but to put trust into organizations.

Some photographer gives images to a news organization, and they take the photographer's word for it that these images are real before they sign and redistribute them. They trust the reporter, and you trust the organization. Or if the reporter has built enough credibility, they can vouch for the images themselves and you can trust them directly.

Cryptography allows you to verify that this reporter or organization attests that the images are what they claim. It doesn't allow you to verify whether the organization is worthy of your trust.

Either way, the system relies on being able to trust people, not things.