Previously we were fetching the public keys over the network, this method was not resilient against bad actors who take over one of our dependencies and publish malicious images with those keys.
