HTTPS for Music: Who Plays the Certificate Authority?

Twenty years ago, much of the web operated in plaintext. Security was lacking, and it was difficult to ascertain which server a user was communicating with. The solution was not legislation or detection; it was a protocol with a trust layer built around it. Today, HTTPS is so commonplace that the padlock in the address bar goes unnoticed.

This represents the ideal outcome for infrastructure: invisibility. Music finds itself in a similar predicament in 2026. Since August 2, 2025, Article 50 of the EU AI Act mandates that audio generation systems embed machine-readable markings to identify synthetic content. The onus is on proving that a piece of music was created by a human, on a specific date, before anyone had reason to doubt its authenticity.

In an era where machines must disclose their origins, anyone lacking proof is suspected. Detection alone cannot bridge this gap due to a structural limitation: detection methods measure the exact metric that generators aim to improve, meaning any enhancement in synthesis quality becomes a setback for detectability. According to Deezer's data, the situation has worsened: from 10,000 fully AI-generated uploads per day in January 2025 to around 90,000 per day by June 2026, accounting for more than half of all new deliveries.

The critical question shifts from "how do we detect fakes?" to "how did the web establish authenticated identity and secure transport, and can music replicate this achievement?" The success of HTTPS lies in four factors that were not directly related to cryptography. Firstly, the protocol was open and freely available; revenue was generated around it.

Secondly, browsers made the absence of security visible through padlocks and "not secure" warnings. Thirdly, a few key players imposed the standard, and the remainder followed suit. Lastly, a trust infrastructure linked keys to identities, ensuring that each public key was authorized for its respective domain, with browser trust in the authority issuing the binding being paramount.

Applying these lessons to the music industry, a provenance protocol for music must be openly specified and implementable by anyone, with the business model revolving around verification, integration, and the trust layer rather than the protocol itself. The author designed such a protocol and has made its technical paper publicly available, but the principle remains the same regardless of who ultimately creates the winning specification.

Making the absence of provenance data visible at the point of ingestion, akin to the "not secure" warning for insecure websites, would compel artists to adopt provenance records. Currently, voluntary, track-level labels indicating AI-generated or AI-assisted content are being proposed, but a standardized record is yet to be established.

Music's chokepoints are its Digital Audio Workstations (DAWs) at the source and distributors at ingestion, where verification is relatively inexpensive, and uploaders already warrant ownership of the rights they deliver. Convincing a few DAWs and distributors to adopt these standards could lead to widespread adoption, similar to the browser HTTPS adoption.

Lastly, binding cryptographic keys to identities is not solely a cryptographic challenge; it requires someone to bind the key to a person, which is best accomplished by existing music collective management organizations. These organizations already verify member identities, maintain work registers, hold legal authority to distribute royalties, and have a vested interest in adopting this role as the scale of synthetic catalogs increases, leading to higher costs associated with declaration-based payments and making legitimate rightsholders bear the friction.

The natural role for a certificate authority in music may lie with these collective management organizations, which already possess the necessary infrastructure and incentives to take on this responsibility.