Which is good, and is definitely a start (and more than I've heard any others doing) - but the only long term solution is that all non-generated images (ie real photos) are signed as such.
Otherwise malicious actors will just strip the metadata out of the generated one.
Otherwise malicious actors will just strip the metadata out of the generated one.