But how do you check that it was actually taken by a camera and not just tagged as such?

Secondly, even if you solve that, how do you know it's not a photograph of an AI-generated scene?

I think this is very obviously not the right approach.

I theory you could install some kind of TPM-like device to every hardware that signs the data with key generated by manufacturer. Should be designed in such a way that it is very easy to break it when trying to tamper with it

I guess both the camera and the image need keys. (But really I have no idea this stuff is out of my realm!)