And this seems designed around the assumption that the physical camera can be trusted indefinitely