[EKS][Feature Request]: Native support for AWS Signer-based image verification without external admission controllers

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
I would like to request native support in Amazon EKS to enforce container image signature verification using AWS Signer (ECR Managed Signing), without relying on external admission controllers like Kyverno or Gatekeeper.

Specifically, a feature where EKS can:

Enforce that only images signed by specific AWS Signer profiles are allowed to run
Reject unsigned or untrusted images at deployment time
Provide cluster-level configuration similar to admission control (Audit / Enforce modes)

**Which service(s) is this request for?**
Amazon EKS
Amazon ECR
AWS Signer

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
I am implementing a secure container supply chain using:

ECR Managed Image Signing (AWS Signer)
Amazon EKS for workload deployment

While signing works correctly and signatures are visible in ECR (OCI referrers), there is no native AWS mechanism to enforce signature verification at deployment time.

Currently, verification requires external tools such as:

Kyverno + kyverno-notation-aws
Gatekeeper + Ratify

This introduces several challenges:

Additional operational overhead (managing admission controllers)
Dependency on community-supported integrations
Increased complexity in maintaining trust policies and verification services
Potential reliability concerns (availability, scaling, failure handling)

There is no built-in EKS feature or AWS CLI/API to enforce or verify signatures directly.

**Are you currently working around this issue?**
Yes, currently using:

Kyverno as admission controller
kyverno-notation-aws integration for AWS Signer verification

While this works, it adds complexity and is not a fully AWS-managed solution.

**Additional context**
AWS documentation references Kyverno and Gatekeeper-based approaches, but there is no native EKS enforcement capability today.

A fully managed AWS-native solution would significantly simplify implementation and improve reliability.

Desired capability:

Cluster-level policy:
Allow only images signed by a specific AWS Signer profile (ARN)
Deny all others
Native verification integrated into EKS control plane
Optional Audit / Enforce modes
Minimal operational overhead

Example use case:

Allow only images signed by:
arn:aws:signer:ap-south-1::/signing-profiles/

**Attachments**
N/A

No repository files, tests, or implementation entry points are identified; begin by reviewing the EKS, ECR Managed Image Signing, and AWS Signer integration described in the request, along with the current Kyverno and Gatekeeper approaches. Done would require an agreed native cluster-level policy that verifies approved signer profiles and supports the requested Audit and Enforce behavior.

Written by the indexing model from the issue text.