Cosign

Uses Sigstore's Fulcio certificate authority and Rekor transparency log for identity-based signing without managing private keys, as shown in the default 'cosign sign' flow that prompts for OIDC authentication.

Supports signing not just container images but also binaries, WASM modules, eBPF programs, and in-toto attestations, all stored in OCI registries, as detailed in the 'Working with Other Artifacts' section.

Stores signatures directly in the same OCI registry as the artifact using a naming convention, avoiding the need for external signature management services, though this can lead to orphaned signatures.

Works with major KMS providers like AWS KMS, GCP KMS, Azure Key Vault, and HashiCorp Vault, as well as hardware tokens, providing flexible key management options for enhanced security.