Sign the container image using cosign, and add a script/package for installing the keys on a regular Silverblue install.