[Feature request] Cosign/Sigstore signature verification before updating images

Feature Request Checklist

• I checked existing issues and discussions for duplicates.
• This is a feature request, not a support question.

Problem Description

Watchtower updates a container whenever it detects a new image (by tag or digest), but never verifies that the new image is signed or came from a trusted source. Docker Content Trust only covers Docker Hub, and even there many publishers don't sign their images, so on self-hosted or private registries (e.g. Harbor, which supports Cosign-signed artifacts natively) there's currently no way to stop Watchtower from pulling and deploying a tampered or unauthorized image.

Desired Solution

Add an opt-in signature-verification step to the update flow: before swapping a container to a new image, Watchtower checks the image's Cosign/Sigstore signature (and optionally attestations) against a configured public key, keyless OIDC identity, or Rekor transparency-log entry, and skips the update if verification fails.

Suggested shape:

• A global flag/env var, e.g. --cosign-verify / WATCHTOWER_COSIGN_VERIFY, plus a key/identity source (--cosign-public-key, --cosign-keyless-identity, --cosign-keyless-issuer).
• A per-container label override, consistent with existing labels like com.centurylinklabs.watchtower.scope, e.g. com.centurylinklabs.watchtower.cosign-verify / ...cosign-key, so verification can be required for some containers and skipped for others.
• Implementation via sigstore/cosign's Go verification packages rather than reimplementing signature checking.
• On verification failure: log and skip the update (never fall back to deploying unverified), surfaced through Watchtower's existing notification channels.

Current Alternatives or Workarounds

• Docker Content Trust — only works for Docker Hub images that are actually signed, and isn't available on Harbor/GHCR/GCR-style registries.
• Admission-controller-based verification (e.g. Sigstore Policy Controller, Kyverno) at the Kubernetes layer — not applicable to plain Docker/Compose hosts, which is Watchtower's primary use case.
• A pre-update lifecycle script that shells out to cosign verify and aborts — possible, but doesn't integrate with Watchtower's own update/skip/notify lifecycle.

Additional Context

Originally filed as containrrr/watchtower#1774 (2023-09-24). That repository is now archived, so re-filing here to continue the request against the active fork. Sigstore/Cosign has since become the de facto standard for OCI image signing (Kubernetes SIG Release, GitHub artifact attestations, etc.), strengthening the case for first-class support rather than a workaround.