cosign You Cannot Phase In a Signature Policy Every other Kyverno policy can be trialled in Audit mode first. Image-signature verification cannot — Kyverno 1.17.2 refuses mutateDigest:true together with failureAction:Audit, and rejects the policy outright.
