Hi everyone, new here. I've been setting up NanoClaw in my homelab to play with some AI agents.

I was looking at the security docs and noticed something that made me a bit nervous. The container image signing for the task isolation... it isn't enabled by default, right? I checked my config and the `verify_signatures` flag was off.

Isn't that a big gap? If the model pulls an unsigned or tampered image for an agent task, the whole "container-first" isolation idea seems weaker. Sorry if this is a basic question, but shouldn't this be on by default, especially for security? What am I missing? 😅

I'm using the default Docker setup. Do I need to manually generate keys and turn it on for it to be meaningful?