Trying to attach unsigned attestations will most likely break

[puerco]

If you specify sign=false and try to attach the unsigned attestation to an image, it will most likely fail as we have code to unmarshal the dsse envelope but not the intoto file directly.