How do we decide whether an image is a trustworthy artifact for production use?
Currently we have a trusted registry, but we could trust individual artifacts.
Scope of this task
- Outline potential future problems with the trusted registry model
- Talk through alternative models with ServiceOpsen
- Come to an agreement about workflow