With respect to docker's security system.
Is it possible to somehow get images signed by some entity that has trust from a company's CA-cert and then be able to find out who signed the image?
It seems like Docker Trusted Registry (DTR), and Notary in general, have a binary mode of trust: either an image is signed or it is not, but it is not qualified by who performed the signing.