CB Control Plane

Containerized publisher — artifacts signed by an isolated signer.