This should be for both runtimes (#44) and layers If a layer or runtime is known to be signed, a more extreme 'has been tampered with, scan for malware' warning should be shown.