Problem Statement
Describe a practical key management approach for signing code and containers.
Explanation
Prefer short-lived keys tied to workload identity. In CI, use O I D C to get a token and sign with a transient key or a service that attests the identity, as Sigstore does. Store long-lived keys only in a managed H S M with strict roles and rotation. Record signatures in a transparency log when possible. Enforce verification at deploy time so signatures are not just decorative.
Code Solution
SolutionRead Only
cosign sign --keyless image:tag // CI identity via O I D C; verify on admission
