Possibly to deal with the ozone things like this can produce.

It’s true. And it’s worse since people worry about the security of the OS but download large batches of suspect apps and games.

Media and games. Only loaded and run when I’m using them.

Package dependencies? How much of that is loading at runtime? How many security holes and exploits is some sub, sub, sub package going to introduce?

Why not go with some kind of certificate chain instead?

Here’s the image… signed… here’s who signed it.

Is it for edit/changes?

Here’s an image that was edited based on an earlier image. Here’s who signed that… and it’s base images hash which can then be looked up if they decided to see what those images were?