[anaphor]

I'm considering building a registry (manually to start with) using https://tahoe-lafs.org/trac/tahoe-lafs as a PoC to see if it could work. If it does, then that gets you verifiability, immutability, as well as the ability to make any image you want public without making other ones you own public. The only potential downside is that it might not work with the existing docker mechanisms for pulling images.