Hmm, how about watermarking the photo with some function of the OTP? (like bit steganography; invisible to normal human use)

Seems to preserve easy checking by device manufacturer, but not immediately clear to me how to replace the sensor in a way that gets a signed image.

And if it seems like a bit of trouble, I think it's still worth consideration by the manufacturer, as a feature for their images and support of a community of users who want to produce images that can be so validated