As per the steps in https://www.elastic.co/docs/deploy-manage/deploy/self-managed/install-elasticsearch-docker-basic the images from elastic can be verified using cosign to ensure there is no supply chain attacks.

but, eck operator images are not signed due to which verification can not be done.