Do not download the Trust List on every user request. Reports record trust_list_version. A self-signed sample is not labelled “forged” merely because it is unlisted.
Learn
C2PA Trust List
A Trust List is a set of trusted certificate anchors. Roma Verify caches the official list and separates C2PA Trusted from Roma Verified. Failed fetches reuse the last good cache and mark it stale.