Also notary from docker can prevent MIM injection in the layers as they are being uploaded and downloaded (a surprisingly easy task actually, I think someone did it without having to break SSL).