> What we don't want is the operation silently substituting a site-specific image, without the knowledge of the end user, thereby breaking their build in a thou

> What we don't want is the operation silently substituting a site-specific image, without the knowledge of the end user, thereby breaking their build in a thousand invisible ways But this is not preventable in any way but explicitly pulling an image with a signing key. Who knows what index.docker.io resolves to or is serving?