### What happened

The v1.93.0 release notes instruct users to verify `ghcr.io/berriai/litellm:v1.93.0` with the public key pinned at commit `0112e53046018d726492c814b3644b7d376029d0`. Following those instructions with cosign v2.6.1 returns `no signatures found`.

### Reproduction

```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/litellm:v1.93.0 ```

Result:

```text Error: no signatures found ```

The published OCI index digest is `sha256:a1745e629abfb17d434426ff48b115f54f4f4c4a0f5af241de569e93c63c411e`. Verifying the linux/amd64 manifest directly also returns the same error:

```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/litellm@sha256:4ce6c997f7652cf4ed787eef8db8b013f1cd6b79af8280c43f782f8491f6adad ```

### Expected behavior

At least the release tag/index or platform manifest should carry a signature verifiable by the documented key, or the release notes should identify the exact signed digest/reference.

Could you confirm the intended signed reference for v1.93.0 or r…