Note that CNCF's Distribution (formerly Docker's Registry) includes support for backing a registry with Cloudfront signed URLs that pull from S3. [1]

https://distribution.github.io/distribution/storage-drivers/...