What is a common mistake with image signing and provenance in Container Security?

Trusting any image from an internal registry without verifying its build origin leaves supply-chain gaps.