Roma sniffs MIME type rather than trusting extensions. Malformed JPEGs can still confuse parsers, so analysis runs in an isolated process with timeouts.
Learn
C2PA for images
Image credentials are typically embedded in JUMBF/APP segments or PNG chunks. Save-as, requantization, and canvas crops make verification fail or drop the manifest.