Signed images

[michaelbeaumont]

Description:
I think it's probably relatively straightforward to add cosign's keyless signing to the GH release workflow

Relevant Links:
envoyproxy/envoy#14076 is of course important as well but it seems to have stalled out

[jukie]

Similar to the discussion there my only concern would be key management. I can help setup repo env vars, etc. as needed but maintainers will need to discuss this.

[michaelbeaumont]

It's pretty common to just rely on Github OIDC and keyless signing.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[michaelbeaumont]

Not stale

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[michaelbeaumont]

Not stale