#sigstore

Every deploy blocked after rotating our cosign key: Kyverno verifyImages pinned the old key

We rotated the cosign key used to sign container images, and within minutes Kyverno rejected every new pod in production: no matching signatures. The policy trusted only the old public key, and images signed before the rotation needed it too. How we recovered and the staged rotation we use now.