my custom oci images, but as close to upstream as possible. if you want something more usable ootb, you're probably looking for ublue
i probably won't be using this until sigstore's keyless signatures from a workflow are supported by rpm-ostree/spokeo