Please reopen discussion #1171

> Verifying the build attestation is something that I think should be done as part of the build pipeline, not per client.

The build attestation is generated at build time, and while validating it after generating it is a good idea, part of the point of it is to allow consumers to ensure that a build was generated from a specific commit using a valid runner. So in much the same way that clients verify an image signature to ensure that the image was published by a holder of a valid private key, clients should also IMO verify an image attestation if present to ensure that the image was built against a valid commit using a valid runner.