Lightweight mechanisms provide a way to assert provenance when live streaming media content and establish provenance upon playback. For example, a provenance claim generator generates a key pair including a live-stream private key and live-stream public key. The claim generator signs, with a long-term private key reliably associated with a sender, manifest metadata including the live-stream public key, thereby producing a manifest signature. During live streaming, the claim generator signs respective portions of media content with the live-stream private key, producing portion signatures for the respective portions. A provenance claim validator receives the manifest signature and manifest metadata. The claim validator verifies the manifest metadata using a long-term public key (reliably associated with the sender) and the manifest signature. During live streaming, the claim validator verifies the respective portions of the media content using the live-stream public key and the portion signatures for the respective portions.