How should image signing and provenance be designed for production in Container Security?

Sign images in trusted CI, record provenance, restrict deployable registries, and verify signatures with admission policy.