content trust: key-sign published docker images

We should look into [keysigning](https://en.wikipedia.org/wiki/Keysigning) our published Docker images using Docker's built in [content trust](https://docs.docker.com/engine/security/trust/) tools.

Vehicles are valuable assets, and it's likely important for some of our users to be able to verify that the images they're installing are indeed unmodified from what we've published.