Trust is the most important part. You trust someone they made something themselves. They digitally sign their work with a public key that is known to be theirs. You can now verify they (the person you trust) made it.
Once the trusted creator’s key is leaked, they are no longer trusted for future works.
AI made content can be freely signed as well, but if you don’t trust the origin, the signature doesn’t matter anyway.
The key thing is trust, the signature is just there to verify.