What Does Container Image Signing Actually Prove, and How Should the Whole Supply Chain Be Enforced?
We sign every image built in our pipeline with Cosign, but I'm trying to separate what that signature proves from what we might be assuming it proves. It…