Cosign's keyless mode needs a CI platform Fulcio trusts and a live path to public Sigstore at admission time. This cluster fails one of those for one CI platform, and fails the other for both — so the phase-in policy ships key-based only.

cosign v3.1.3 refuses --tlog-upload=false with --signing-config, which blocks signing on a host with no public Sigstore egress. The fallback to v2.6.5 signs in under a second and puts a .sig tag straight into the registry catalogue.