Comment by Lemmi

That's why you only pull official images and signed ones.

And that's why I have an in-between step.

Harbor.io allows you to configure it as a proxy with approval mechanism and cve scanning