I was curious and, yeah, it seems like docker hub not requiring signature means many popular publishers don’t bother to sign. But that’s not to say it can’t be done. For example: github.com/sigstore/cosign

Today, cosign has been tested and works against […] Docker Hub