How should image signing and provenance be designed for production in Container Security?

Sign images in trusted CI, record provenance, restrict deployable registries, and verify signatures with admission policy. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.