During a supply chain security audit, a platform engineer discovers that container images deployed into the cluster are being pulled from public registries without cryptographic verification of their provenance or integrity. Which integrated Kubernetes security control should be implemented alongside an admission webhook to verify image signatures before admission?