Whether or not to trust Bob is an entirely different problem space than being able to prove an image came from Bob. In most scenarios Bob would be “trustworthy news source” who cares about their reputability. The important piece here is that if someone shares something on e.g. twitter and says Bob produced it, that claim can be verified.
> crack any camera by any manufacturer can extract the private key and use it to sign whatever they want, which is inevitably going to happen … Since that makes the whole system worthless, what's the point?
Think about what happens today when a private key is leaked - that key is no longer trusted. Will it be such a large scale problem such that the day any camera is released the keys are leaked? Maybe. Even in that scenario though we end up in the same spot as today except with the additional benefit of being able to verify stuff coming from NPR/CNN/your preferred news source that is shared on third party platforms.