If you're looking for cryptographic signatures on container images, check out what my company Sylabs.io is doing. I wrote a comment on the other HN thread about this breach: https://news.ycombinator.com/item?id=19769590