[Security] Is it time to sign the Docker images ??

Subject of the issue

Docker images when [signed]( are more "secure" in the case of a security event because a non signed image could not be pulled if the previous one was signed.

Deployment environment


Docker

Steps to reproduce






Expected behaviour


Have a signed image I can trust

Actual behaviour


No signed image

Troubleshooting data


All needed information can be found in official docs and in the GitHub action:

All the needed commands can be copied from

Is it easy to implement: Yes

Do you have to backup in a very safe place the repository and root keys, YES !!

Knowing nothing about DCT I implemented a GitHub action in a bunch of hours, I can provide help for the setup if needed