Signed, and signed by whom
The pipeline verifies that every artefact it pulls carries a valid signature and refuses anything unsigned. That check has been green for a year.
Someone published a malicious build under an internal-looking name and signed it — genuinely, verifiably — using a free identity they obtained in about ten seconds. Verification passed, because "is it signed" was the whole question being asked.
Boundaries, outermost first: Verification: Signature valid? (the only check; FAILED: passes for both), an empty slot for the which subject signed, an empty slot for the issued by which provider Outside every boundary: Your build (signs each artefact), Anyone at all (cert in ten seconds), Production Connections: Your build calls Signature valid? (step 1) Anyone at all calls Signature valid? — also valid (step 2) which subject signed controls Signature valid? (step 3) issued by which provider controls Signature valid? (step 4) Signature valid? calls Production (step 5) Anyone at all must NOT reach Production — now refused