diff --git a/conformance/incluster/Containerfile b/conformance/incluster/Containerfile
index adae986..5cb395c 100644
--- a/conformance/incluster/Containerfile
+++ b/conformance/incluster/Containerfile
@@ -67,10 +67,18 @@ RUN set -eux; \
     : "${KUBECTL_VERSION:?pass --build-arg KUBECTL_VERSION from infra/devcontainer/versions.env}"
 
 # Same URLs and the same arch handling as infra/devcontainer/Containerfile, so the chainsaw
-# and kubectl in this image are the same builds the toolbox gate runs with. kubectl's
-# published sha256 is verified; chainsaw publishes no per-asset checksum file at a stable
-# URL, so its integrity rests on the tag + TLS (and, after the operator pushes, on this
-# image's own digest).
+# and kubectl in this image are the same builds the toolbox gate runs with.
+#
+# INTEGRITY, MEASURED NOT ASSUMED. kubectl publishes a plain `<url>.sha256`, so it is verified
+# below. chainsaw publishes NO checksums file — the v0.2.12 release assets are the tarballs plus
+# per-asset cosign `.sig`/`.pem` and an SBOM (listed via the GitHub releases API). So chainsaw's
+# integrity here rests on the tag + TLS, and afterwards on this image's own digest.
+# TODO, worth doing and deliberately not smuggled in here: verify chainsaw with
+# `cosign verify-blob --certificate chainsaw_linux_amd64.tar.gz.pem
+#  --signature chainsaw_linux_amd64.tar.gz.sig ...`. That needs cosign in the builder stage and
+# the correct keyless identity/issuer for kyverno's release workflow — a supply-chain decision
+# that belongs in its own reviewed change, not as a silent addition to a runner image.
+# infra/devcontainer/Containerfile has the same gap for the same binary.
 RUN set -eux; \
     mkdir -p /out; \
     curl -fsSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl" \