Going even further with this - it has always struck me that the ALWAYS should be just be a hash of the docker image such that it is essentially content addresse

Going even further with this - it has always struck me that the ALWAYS should be just be a hash of the docker image such that it is essentially content addressed and can be verified on the receiver end. Is there any reason that this isn't a good idea?