We will still need a centralized party that holds the secret keys for validation through
You definitely don't want one single leakable entity.
Some of them possibly could be updated, but this will take time. Securing the keys within them is also going to be a problem; not all of them have a TPM.
Also, what about someone putting a screen just in front of the sensor?
A private key is generated on device and never leaves it. It sits inside a TPM or equivalent.
The public key is pushed to a well-known site, visible to all.
Every shot is signed by hashing the bits into a reasonably short string (say, using sha512) and then encrypted with the private key.
Anyone can now decrypt the hash, and compare it with the hash they computed from the bits.
The problem, of course, is that any transformation whatsoever breaks the signature. You can't adjust levels and contrast, you can't even crop. Maybe it's a good property.