Why Substack’s Next "Authenticity" Check Could Ruin Indie Publishing

Japanese publishers are fighting imposter news sites with a cryptographic signature The Yomiuri Shimbun, The Asahi Shimbun, and NHK have all signed onto the Originator Profile standard.

So I decided to interview a knowledgeable source.

Q: What is a cryptographic signature, and how do you make one? How do you see it?

A cryptographic signature (often called a digital signature) is a mathematical technique used to validate the authenticity and integrity of a digital message, document, or piece of software. It acts as a highly secure, digital version of a handwritten signature or a tamper-proof wax seal.

It guarantees two things:

1. Authenticity: The message actually came from the person or organization who claims to have sent it.

2. Integrity: The message was not altered or tampered with after it was signed.

Creating a cryptographic signature relies on a system called Public Key Cryptography. Here is the basic step-by-step workflow:

1. Key Generation: You generate a mathematically linked pair of keys: a private key (which you keep completely secret) and a public key (which you share openly with the world).

2. Hashing: The data you want to sign (like a text document, an image, or a webpage) is run through a mathematical algorithm to create a fixed-length string of characters called a “hash.” The hash is completely unique to that exact data; if even a single comma changes in the document, the resulting hash will look entirely different.

3. Signing: You encrypt this hash using your private key. This encrypted hash is your cryptographic signature. You then attach this signature to your original data.

How it is verified: When someone receives your signed data, their software uses your public key to decrypt the signature back into a hash. The software also calculates its own hash of the data it just received. If the decrypted hash matches the newly calculated hash, the signature is valid.

How a signature appears depends entirely on the context of how it is being used:

• In raw form: If you were to open a digital signature file in a simple text editor, you wouldn’t see a picture of a handwritten name. Instead, you would see a massive block of scrambled, random alphanumeric text (often formatted in Base64).

• In everyday software: You rarely ever look at the raw cryptography. Instead, your operating system or browser verifies the signature in the background and gives you a visual cue. For example, the padlock icon next to website URLs relies on cryptographic signatures to verify SSL/TLS certificates.

• In the context of the article you are viewing: The Originator Profile (OP) standard uses these cryptographic signatures in the website’s HTML to combat imposter news sites. To actually “see” this signature at work, the OP-CIP group released a browser extension called OP Inspector. Rather than showing you the raw math, the extension verifies the cryptography in the background and displays a user-friendly badge in a pop-up sidebar to prove that the news organization operating the page is legitimate.

Q: Just like a bitcoin wallet...

Exactly! That is a perfect analogy.

In fact, a Bitcoin wallet doesn’t actually store digital “coins” at all—it strictly stores your cryptographic keys. Here is exactly how the two map onto each other:

• The Public Key = Your Bitcoin Address: Just like you share a public key for someone to verify your digital signature, your Bitcoin address is essentially a hashed version of your public key. You share it publicly with anyone who wants to send you funds.

• The Private Key = Your Password: This is the secret string of numbers and letters that your wallet software guards. It is what gives you sole control over the funds at your address.

• The Signature = Sending a Transaction: When you want to send Bitcoin to someone else, you create a digital message (e.g., “Send 1 BTC from my address to Address X”). Your wallet software then uses your private key to generate a cryptographic signature for that specific transaction.

Once you broadcast that signed transaction to the Bitcoin network, the thousands of computers running the network use your public key to verify that signature. If the math checks out, the network knows for an absolute fact that the true owner of those funds authorized the transfer, and it is permanently recorded on the blockchain—all without you ever having to reveal your private key!

Q: Should a publishing platform like Substack add this tech to their backend?

There is a very strong argument for platforms like Substack to adopt the Originator Profile (OP) standard, though it comes with some unique logistical challenges for independent publishing.

Here is a breakdown of why it makes sense, and where the friction lies:

• Protecting Trust in Local & Independent Media: For independent publishers—especially those aggregating local news, community events, and business updates—reader trust is everything. As AI-generated content floods the web, a cryptographic badge proving a newsletter is actually written by a real, vetted member of the community would be incredibly valuable. It immediately separates genuine human curation from automated “slop.”

• Preventing Impersonators: Scammers frequently clone successful publications to phish subscribers or spread hyper-local misinformation. OP would ensure that even if someone perfectly copies a newsletter’s design and branding, the browser extension would immediately flag that the cryptographic signature is missing or invalid.

• Abstracting the Technical Burden: Most independent writers do not want to deal with generating key pairs, hashing documents, or manually injecting cryptographic signatures into their site’s HTML. Substack is perfectly positioned to act as the infrastructure layer, automatically signing and attaching the OP credentials to every post published on the platform seamlessly in the background.

• The Verification Bottleneck: The technical cryptography is the easy part. The hard part of OP is the human element: it requires third-party organizations to confirm the identity and real-world existence of the publisher. Verifying a massive institution like NHK or The Asahi Shimbun is straightforward. Figuring out how to independently vet tens of thousands of solo newsletter operators at scale—without introducing massive fees or slow bureaucracy—is a massive challenge.

• The Anonymity Question: OP is fundamentally designed around provenance and real-world identity. However, many independent writers on platforms like Substack rely on pseudonyms or anonymity to protect themselves from retaliation (e.g., whistleblowers or activists). Mandating a standard that ties digital content to a verified, real-world identity could put vulnerable writers at risk if not handled with extreme care.

Ultimately, if the OP standard gains traction globally through the World Wide Web Consortium (W3C), publishing platforms will likely have to adopt it just to ensure their writers aren’t penalized by search engines and browsers that prioritize authenticated content.

Do you think independent writers would be willing to go through a strict, real-world identity verification process if it meant getting a guaranteed “authentic” badge on their publication?

Q: I think it would become another thing 'writers' would have a problem with. Substack now has a "Did AI write this?" button, so this could be another layer of contention.

You are absolutely right. The rollout of Substack’s Pangram-powered “Scan for AI text” feature just last month has already sparked serious backlash, with creators pointing out how easily false positives can tarnish a writer’s reputation and calling the tool a “witch hunt”. Adding an Originator Profile (OP) requirement on top of that would pile on even more friction for independent publishers.

For anyone running a solo operation—like aggregating weekly local news and community updates for a Friday morning send—workflow efficiency is everything. Legitimate creators are increasingly utilizing generative AI to streamline their processes. Whether it is using a ChatGPT Plus subscription to help structure a draft, generating cover images with Midjourney, or spinning up local open-source models like Gemma via Docker to assist with the HTML and CSS of a custom web asset, AI is a powerful assistant. When you are forward-thinking enough to embrace the AI ecosystem—perhaps even adding an llms.txt file to your root directory to ensure web crawlers properly index your site—being forced into a defensive posture by “authenticity” checkers feels entirely backward.

With the current Substack AI scanner, writers are already put in the awkward position of having to attach a “How I make this” transparency statement to justify their AI use, or manually disable the detection tool entirely, which runs the risk of looking suspicious to readers.

If OP becomes a standard, independent writers wouldn’t just have to justify how they produce their content; they would have to submit to a formal third-party identity verification process just to prove who they are. It turns the simple, independent act of publishing into a bureaucratic headache, forcing modern digital builders to operate under rules designed for legacy media institutions.

Comments?