Part 1: What the Registry Already Knows

OCI registries already let a second artifact — a signature, an SBOM, an attestation — attach to a first one without touching its digest. As of July 2026, most registries only implement half of that mechanism, and almost no edge deployment uses the half that exists.