Between your pipeline and production, an image could be swapped or a tag moved to point at different bytes. Signing lets the cluster check that an artifact came from your pipeline and has not changed since. Use it when you deploy by image digest and want the cluster to refuse anything unsigned. A valid signature proves who built it and that it is unchanged, not that the code is free of bugs or vulnerabilities.