Feature Request: Support signed images

[AlexGustafsson]

User stories

• As a user I want to understand what images are signed or not

Feature description

Support notary / signed docker images.

[AlexGustafsson]

Cosign seems to be more prevalent. By default it seems to create a separate tag for its manifest, which would require an additional lookup for each container. It can be configured to use the OCI referrers API, but it's unclear if that is widely used by cosign users. Notary uses the referrers API by default, but it seems to be more rarely used.

[AlexGustafsson]

GitHub doesn't yet seem to have OCI 1.1 referrers support, meaning adoption is likely limited. The fallback is using tags for signatures (.sig suffix), but that seems a bit nasty. For now, perhaps wait for support to catch up.