diff --git a/static/schemas/Builder.schema.json b/static/schemas/Builder.schema.json
index fc96f20..113d686 100644
--- a/static/schemas/Builder.schema.json
+++ b/static/schemas/Builder.schema.json
@@ -53,7 +53,7 @@
     "instance_id": {
       "description": "Instance ID from `xmpMM:InstanceID` in XMP metadata.",
       "type": "string",
-      "default": "xmp:iid:1ff4f129-6187-4f95-8910-01b36ffe60d0"
+      "default": "xmp:iid:7719d3bf-dfea-4b61-a99b-72c226ea0527"
     },
     "thumbnail": {
       "description": "An optional ResourceRef to a thumbnail image that represents the asset that was signed.\nMust be available when the manifest is signed.",
diff --git a/static/schemas/ManifestDefinition.schema.json b/static/schemas/ManifestDefinition.schema.json
index 38f5ac3..790bdea 100644
--- a/static/schemas/ManifestDefinition.schema.json
+++ b/static/schemas/ManifestDefinition.schema.json
@@ -53,7 +53,7 @@
     "instance_id": {
       "description": "Instance ID from `xmpMM:InstanceID` in XMP metadata.",
       "type": "string",
-      "default": "xmp:iid:536313a0-eac9-4392-bbfd-b30a9dbd0be5"
+      "default": "xmp:iid:ae205f09-0b8e-4f16-8954-ac4d4620efb9"
     },
     "thumbnail": {
       "description": "An optional ResourceRef to a thumbnail image that represents the asset that was signed.\nMust be available when the manifest is signed.",
diff --git a/static/schemas/Reader.schema.json b/static/schemas/Reader.schema.json
index c0338a3..b821584 100644
--- a/static/schemas/Reader.schema.json
+++ b/static/schemas/Reader.schema.json
@@ -108,7 +108,7 @@
         "instance_id": {
           "description": "Instance ID from `xmpMM:InstanceID` in XMP metadata.",
           "type": "string",
-          "default": "xmp:iid:f76c3bfc-3ab0-4d69-9d17-4198272bdc4a"
+          "default": "xmp:iid:c452d608-1763-4c14-80bc-01ce2baa2c5c"
         },
         "thumbnail": {
           "anyOf": [
diff --git a/static/schemas/Settings.schema.json b/static/schemas/Settings.schema.json
index 49ab3df..2b96333 100644
--- a/static/schemas/Settings.schema.json
+++ b/static/schemas/Settings.schema.json
@@ -15,17 +15,15 @@
       "description": "Settings for configuring the C2PA trust lists.",
       "$ref": "#/$defs/Trust",
       "default": {
-        "verify_trust_list": true,
         "user_anchors": null,
         "trust_anchors": null,
         "trust_config": null,
-        "allowed_list": null,
-        "trusted_ica_issuers": null
+        "allowed_list": null
       }
     },
     "cawg_trust": {
       "description": "Settings for configuring the CAWG trust lists.",
-      "$ref": "#/$defs/Trust",
+      "$ref": "#/$defs/CawgTrust",
       "default": {
         "verify_trust_list": true,
         "user_anchors": null,
@@ -132,14 +130,9 @@
   },
   "$defs": {
     "Trust": {
-      "description": "Settings to configure the trust list.",
+      "description": "Settings to configure the C2PA trust list.\n\nThis configures the trust lists used when verifying C2PA manifest signers.\nCAWG identity trust is configured separately via [`CawgTrust`].",
       "type": "object",
       "properties": {
-        "verify_trust_list": {
-          "description": "Whether to verify certificates against the trust lists specified in [`Trust`]. This\noption is ONLY applicable to CAWG.\n\nThe default value is true.\n\n<div class=\"warning\">\nVerifying trust is REQUIRED by the CAWG spec. This option should only be used for development or testing.\n</div>",
-          "type": "boolean",
-          "default": true
-        },
         "user_anchors": {
           "description": "List of additional user-provided trust anchor root certificates as a PEM bundle.",
           "type": [
@@ -171,6 +164,49 @@
             "null"
           ],
           "default": null
+        }
+      }
+    },
+    "CawgTrust": {
+      "description": "Settings to configure the CAWG identity trust lists.\n\nThis configures trust used when validating CAWG identity assertions. It is\nmodeled separately from the C2PA [`Trust`] because several of these settings\n(such as `verify_trust_list`) apply only to CAWG validation and have no\neffect on C2PA manifest verification.",
+      "type": "object",
+      "properties": {
+        "verify_trust_list": {
+          "description": "Whether to verify certificates against the trust lists specified in [`CawgTrust`].\n\nThe default value is true.\n\n<div class=\"warning\">\nVerifying trust is REQUIRED by the CAWG spec. This option should only be used for development or testing.\n</div>",
+          "type": "boolean",
+          "default": true
+        },
+        "user_anchors": {
+          "description": "List of additional user-provided trust anchor root certificates as a PEM\nbundle, used when validating CAWG X.509 identity signatures.\n\nThese trust lists are independent of the C2PA [`Trust`] settings and are\nconsulted only for CAWG identity validation.",
+          "type": [
+            "string",
+            "null"
+          ],
+          "default": null
+        },
+        "trust_anchors": {
+          "description": "List of default trust anchor root certificates as a PEM bundle, used when\nvalidating CAWG X.509 identity signatures.\n\nUnder the CAWG interim trust model (CAWG identity assertion spec §8.2.4.1,\nvalid for assertions issued on or before 31 March 2027 and carrying a\ntrusted time stamp), these are the CAWG-recognized trust anchors – the\nMozilla Root Store with the Email (S/MIME) trust bit enabled\n(<https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Email>)\nand the IPTC Origin Verified News Publishers trust-anchor list\n(<https://trust.iptc.org/anchor-list.pem>) – not the C2PA conformance\ntrust-list.",
+          "type": [
+            "string",
+            "null"
+          ],
+          "default": null
+        },
+        "trust_config": {
+          "description": "List of allowed extended key usage (EKU) object identifiers (OID) that\nCAWG identity certificates must have.\n\nThe CAWG interim trust model (CAWG identity assertion spec §8.2.4.1)\nrequires the `id-kp-emailProtection` EKU (1.3.6.1.5.5.7.3.4) together with\none of the CA/Browser Forum S/MIME certificate-policy OIDs:\norganization-validated (2.23.140.1.5.2.2 / 2.23.140.1.5.2.3),\nsponsor-validated (2.23.140.1.5.3.2 / 2.23.140.1.5.3.3), or\nindividual-validated (2.23.140.1.5.4.2 / 2.23.140.1.5.4.3). Mailbox-validated\nand legacy certificate purposes are not accepted.",
+          "type": [
+            "string",
+            "null"
+          ],
+          "default": null
+        },
+        "allowed_list": {
+          "description": "List of explicitly allowed CAWG identity certificates as a PEM bundle.\n\nUnder the CAWG interim trust model (CAWG identity assertion spec §8.2.4.1),\nthis corresponds to the IPTC Origin Verified News Publishers end-entity\ncertificate list (<https://trust.iptc.org/end-entity-list.pem>).",
+          "type": [
+            "string",
+            "null"
+          ],
+          "default": null
         },
         "trusted_ica_issuers": {
           "description": "Exact-match allow-list of trusted CAWG identity claims aggregation (ICA)\nissuer DIDs.\n\nEach entry is a full DID string (any DID method) that is compared, after\nstripping any fragment, against the `issuer` of an ICA verifiable\ncredential. An issuer that is not present on this list is reported with\nthe informational code `cawg.ica.untrusted_issuer` for that identity\nassertion and its `cawg.ica.credential_valid` success code is withheld.\n\nThe default value is empty, meaning that NO ICA issuer is trusted. This\nis a deliberate secure default: a self-issued `did:jwk` (or any other\nissuer) is not trustworthy simply because its signature is\nself-consistent. Populate this list with the DIDs of issuers you trust.",