To add to Justin's comment, we merged what we've called "trust pinning" into Notary. We're still iterating on exactly the right scopes to pin to, but anticipate

To add to Justin's comment, we merged what we've called "trust pinning" into Notary. We're still iterating on exactly the right scopes to pin to, but anticipate that making it into docker in the not too distant future. That will enable you to hard fail when pulling images not signed by an explicitly approved source.