by digest in order for the Task to be considered for verification.

Future extensions can allow verification of tag-based images
(e.g., using Cosign, or alternatives). For the purposes of
limiting scope of this TEP, we consider a digest reference
within a signed Task as a signal that the Task signer also
trusts the digest-referenced image.