The industry has developed image signature verification solutions such as cosign (part of the Sigstore project) and Docker Content Trust (based on the Notary protocol) to ensure images have not been tampered with.