But is it still possible that another, entirely irrelevant piece of software could coincidentally produce images with the same header?
Anything to back this up, or just guess work?
Lmao, you guys are stupid.
All JPEG images uploaded to medium.com meet the criteria set out in the OP (no JFIF, xFF xC0 x00 x11 @ 0x88).
Good job, everyone! You have been collecting and brute-forcing random images originally hosted on medium.com.
And it is before the header change.
So we have now established that stegdetect gives false positives, and all medium.com JPEGs meet the other criteria.
A new approach is needed. Perhaps focus less on finding PixelKnot images and more on Q's images.