Sign bundles with Cosign #30
Description
As an improvement, we could start evaluating Cosign for signing our artifacts. We also have an issue in the main Kubeapps project for it, but perhaps it's easier to start in this repo?
See vmware-tanzu/kubeapps#4748 and https://carvel.dev/blog/signing-imgpkg-bundles-with-cosign/