>a screen attack still works: photograph a screen displaying an AI image and you get a signed photo of a fake

you don't need to do that just photograph a screen.

This seems close to worthless in "identifying real photos vs AI" for someone actually wanting to do something bad with an AI image, although probably very useful at identifying which phone took a photo when ("the root of trust stays inside Apple's Private Cloud Compute") seen as it's not an entirely local solution a bad actor government could use their powers to completely abuse this.