Signing Container Images with Cosign

When you pull a container image from a registry, how do you know it actually came from a trusted source? How do you know no one tampered…