how do i sign the t2-atomic-kinoite-hardened image?

[LeastSaneDeveloper]

i need to sign it so i can upgrade it via rpm-ostree upgrade, but i can't seem to do it as it results in this error:

note: automatic updates (stage) are enabled
Pulling manifest: ostree-unverified-registry:ghcr.io/kansei-os/t2-atomic-kinoite-hardened:latest
error: Preparing import: Fetching manifest: failed to invoke method OpenImage: Running image docker://ghcr.io/kansei-os/t2-atomic-kinoite-hardened:latest is rejected by policy.

/etc/containers/policy.json:

{
    ...
    "transports": {
    "docker": {
      "ghcr.io/secureblue": [
        {
          "type": "sigstoreSigned",
          "keyPath": "/etc/pki/containers/kinoite-main-hardened.pub",
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ],
    ...
}