crossplane-runtime's xpkg.CachedClient.Get() resolved a package tag to a digest with fetcher.Head(), had cosign verify that digest, and then re-fetched the image by the original tag - so the verified digest and the pulled bytes came from two independent registry requests. A registry serving different content between the two requests can have verification succeed against a benign signed digest while an unsigned malicious manifest is installed, defeating ImageConfig signature verification. Fixed in 2.3.3 and 2.4.0-rc.1 by pinning both the validator call and the fetch to the resolved digest.