Yonghe Zhao

Thanks @lkatalin for bringing up this issue again. We use `cosign` internally, signing internal images without relying on public sigstore infrastructure to comply with company policies. To achieve keyless signing,...