Does docker have container signing yet? If not, this sounds like it could be a disaster waiting to happen (just compromise dockerhuv credentials!)