ProofMode: a camera app for verifiable photography

My first thought was, how can the proof app tell that its source picture came from the camera app and not from several hours of fakery? If it has some way of telling what app the picture came from, and how quickly, what prevents somebody from faking that app with the fakery app and presenting it to the proof app as just having been taken?

One clue is the time stamp and location. If it's an incident where time or location matters, then any delay or going offsite for quiet manipulation will show up as a discrepancy.

Can the proof app's actions be duplicated by a fakery program? That would make delayed offsite manipulation feasible.

But if the proof app immediately broadcasts a hash of the raw picture, then transmission of the full proofed picture can wait, and manipulation may be impossible.