This is the right approach, but there’s lots of complexity around transcoding. In the courtroom that’s less of an issue if you can get the original unmodified outputs, but broader applications need to think through what it means to be “verified”

What about the recording device itself? Refeed a video/frame/hash back to a security camera and it tells you if it was originally sourced from that specific camera or not.

The sci-fi dystopian answer would be entangled photon lights and off site image recording that preserves entanglement :-)

What shall we do with millions upon millions of existing mobile phones, and also surveillance cameras and dashcams?

Some of them possibly could be updated, but this will take time. Securing the keys within them is also going to be a problem; not all of them have a TPM.

There's no way this would work, either the master encryption key would be leaked, or someone would reverse-engineer the chip.

Also, what about someone putting a screen just in front of the sensor?

No need for that.

A private key is generated on device and never leaves it. It sits inside a TPM or equivalent.

The public key is pushed to a well-known site, visible to all.

Every shot is signed by hashing the bits into a reasonably short string (say, using sha512) and then encrypted with the private key.

Anyone can now decrypt the hash, and compare it with the hash they computed from the bits.

The problem, of course, is that any transformation whatsoever breaks the signature. You can't adjust levels and contrast, you can't even crop. Maybe it's a good property.

Why would you trust the key if it was generated on the device? Anyone could generate a key. You would either need a centralized server to sign that key, in which case you have to trust a centralized company / government agency.

You don't need a centralized database. You have 3 companies 3 different hashes. They catch bob stealing, on 3 different cameras. Each footage can be independently verified as authentic and not doctored. This would prevent anonymous found footage suggesting someone committed a crime.

You definitely don't want one single leakable entity.