Currently we clear any xmp data on the off chance that attribution.yaml has been updated.
This is not the best solution. If users are attempting to license files not owned by them (either in accordance with a cc0 or some other license scheme, or attempting to illegally re-license), this will indescrimantently allow this possibility.