Sensor supplier could embed the crypto in the hardware as close to the imager as possible and issue signing keys for each device. OEM would write firmware to extract that from the camera bitstream and dump it into the metadata of the image (something along those lines anyway)

The image and signature could be added as authentication layers and then a third layer added to allow post-production (crop/levels/etc). Right click in your browser to 'see original image' with a little padlock in the corner. Ideally this would include GPS info to reduce likelihood that someone would just project a desired image on a screen and photograph that.