# Documented cosign verification fails for LiteLLM Docker image v1.91.0

## Summary

The LiteLLM release notes and README state that Docker images published to GHCR are signed with cosign and can be verified with the public key introduced in commit `0112e53046018d726492c814b3644b7d376029d0`.

However, verification currently fails for `ghcr.io/berriai/litellm:v1.91.0` with `no signatures found`. `cosign tree` also reports no supply-chain security artifacts for the image.

I also checked a local checkout of the repository pipeline files. The `create-release.yml` workflow appears to add cosign verification instructions to the GitHub release body, but I could not find a corresponding `cosign sign` step in the GitHub Actions workflow files, CircleCI config, Docker files, or scripts in that checkout.

Related but distinct issue: #27643 reports release-page cosign links returning 404. This issue reports that the documented verification command resolves the key URL but cannot find image signature artifacts to verify.

## Reproduction

```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/lit…