How to prevent unsigned Docker images from being pulled