You sometimes want to use the digest of an image, rather than the tag; e.g., if you are interested in exactly reproducible builds.

For that reason, it'd be useful to supply the digest of an image selected by a policy object, as well as its tag, in the status. The digest appears to be available via https://godoc.org/github.com/google/go-containerregistry/pkg/v1/remote#Head (but if not, Get in the same place). This has to be done per tags, so while we don't need metadata for sorting/selecting, the policy controller can just fetch it for those images it selects.