Maybe not new to you or Docker Inc staff, but I don't see any warnings that a pull could result in complete compromise. On top of this, the inaccurate "verified" image message is still in the current release.
> I have explicitly called out the need for containerization of the 'xz' process, and to run it in an unprivileged context.
Do you have a link to this?
> As this work comes out of review and a specification is finalized, we should expect to see a much better experience and more secure image transport
Is there a draft specification available for libtrust?
> However, as the libtrust and v2 image work, and subsequently, registry protocols are still in draft and security review, it is difficult for us to recommend that users yet attempt deploying these.
And yet you deployed it to production in 1.3.