ing".
 3. Otherwise, it is assigned "kubernetes.io/legacy-unknown".
Distribution of trust for signers happens out of band. You can select on this field using `spec.signerName`.²