Only build manifests created by muncher itself

[nuest]

Is is possible (e.g. via signatures) to only build Dockerfiles that were created by muncher itself?

Is this a security improvement worth having?

Containers can never "call home", only via their output could they provide access to information they generated, and jobs can only be started by humans (ORCID takes somewhat care of that). Therefore a whitelist for base images does not make a big difference (you can still do bad things in your own Dockerfile even if the base image is fine).