cosign verify reg.echohq.com/python:latest \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-identity "https://github.com/buildecho/images/.github/workflows/build-container.yml@refs/heads/main" | jq -r '.[].optional.Bundle.Payload.body | @base64d | fromjson | .spec.signature.publicKey.content | @base64d' | openssl x509 -noout -text
