Signing and verifying images

[Simkiw]

Hi everyone,

I'm learning about DCT, docker container trust, and I'm still confused when it comes to signing and verifying.
The keys are still not clear for me when I read the definitions and try to use them where they have been used in the doc:

• when you push using DCT for the 1st time, it says there are 4 keys generated among them the target key: how it is being used? and how can a consumer verify its signature (unlike the delegation, which public key is stored in notary and serves to verify the image)
• is the target key the same as the private delegation key?
• are there specific use-cases when one should favor one type of key over another?
• finally, the verification process, is there a way to provide some sort of a diagram flow or step by step procedure of what's happening when pushing/pulling a signed image and the role of notary in it, since it's keeping the public key?

There are a lot of details and concepts, and I appreciate all the efforts that are being made, because yes, it is well-documented as far as i can tell, it's just some confusions I ran into and I was hoping I could get rid of them.

If there are some answers you could provide in the meantime, I wouldn't say no to that.
Thank you

[docker-robott]

There hasn't been any activity on this issue for a long time.
If the problem is still relevant, mark the issue as fresh with a /remove-lifecycle stale comment.
If not, this issue will be closed in 14 days. This helps our maintainers focus on the active issues.

Prevent issues from auto-closing with a /lifecycle frozen comment.

/lifecycle stale

[docker-robott]

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

/lifecycle locked