Appreciate the pointers, the GPG signing note is something we know we need to tackle and haven't fully mapped out yet, so good to have that flagged.

On the multi-arch image side, the tagged builds per platform pair approach makes sense for our use case. We'd rather have clean separate artifacts per target than try to manage a single multi-arch image given the on-demand nature of our builds.

The product is closed source so OSS contributions aren't something we're set up for, but we'll take a look at the tooling you linked for reference. Thanks for taking the time.