20 karma · joined August 16, 2011
Checksums are currently uploaded by the client and verified by the registry. Signing is on the roadmap[1]. I'm not sure what you mean by a fingerprint, would this be analogous to an SSH host key? What function would it serve if you already had a signature that only you could reproduce?
That said, we love the Docker ecosystem and way of doing things. A sibling comment mentioned how complicated Docker is, but I think when you realize that they are trying to offer DVCS like features and paradigms, you will realize that it is complicated for a reason. We all thought git was complicated at first as well.
There will have to be an algorithm that decides whose voice should be heard, in which case, maybe they can use a reputation system to make sure I'm not being gamed.