Wouldn't this suffer from the same 'analog hole' as DRM? i.e. just take a photo of whatever image you want to be verified?

This concept describes a hardware anchored proof system for proving the originality of and the precise sensor origin of photographic media. The camera hardware would use a combination of secure enclaves and asymmetric cryptography like RSA to digitally sign images at the moment of capture making it possible to verify the physical origin of the file. The camera manufacturer could operate a Certificate Authority where users can validate the embedded signature against the registered public key of the specific device. This architecture would allow verifying that an image is an actual sensor derived photograph.

The neat part here is that the algorithm survives retouching of the photo, so you can still do typical things like cleaning up contrast, color balance, etc., without destroying the authenticity of the image. Given how good generated images are getting, it seems to me that deepfake detection approach is dead in the water, and something like this would establish a proactive foundation for cryptographic provenance of real photographs.

How can a camera have access to the signing key and prevent an attacker gaining access to that key?

Also, this would give camera companies (and any entity with leverage over the camera company, including their government) the power to decide what images are 'true' in the public's eye. Companies that control the keys would need to be good at securing the keys.