Image signed by a recently removed trusted public key found

Rule Details

Cortex AppSec Rule ID	APPSEC-ATTEST-9
Category - Subcategory	Artifact Integrity Validation - Signing Key & Trust Misconfiguration
Severity	CRITICAL

Impact

An image was signed with a public key that was previously in the Trusted Public Keys list but has since been removed. This typically indicates a key compromise response, employee offboarding, or deprecated build system.