Clarify the purpose of bom signing #33

Job	Run time
images (dotnet6, debian) / image	5m 51s
images (dotnet7, true) / image	3m 51s
images (dotnet8, debian) / image	5m 55s
images (dotnet8, true) / image	5m 7s
images (dotnet9, debian) / image	5m 54s
images (dotnet9, true) / image	5m 30s
images (java17) / image	6m 10s
images (java11, java11-slim, cdxgen-java, cdxgen-java11-slim, cdxgen-java-slim) / image	6m 3s
images (java17-slim) / image	6m 9s
images (java21, temurin) / image	5m 55s
images (java8, temurin) / image	5m 52s
images (node20, cdxgen-node) / image	5m 59s
images (python310, opensuse) / image	5m 49s
images (python311) / image	5m 55s
images (python312, lang, cdxgen-python) / image	5m 51s
images (python36) / image	6m 0s
images (ruby25, true, true, sle) / image	6m 0s
images (python39, opensuse) / image	5m 48s
images (ruby26, debian, macos-hosted, true) / image	1s
images (ruby33, debian, macos-hosted) / image	1s
images (ruby34, debian, macos-hosted) / image	1s
images (swift6, debian, macos-hosted, debian-swift, cdxgen-debian-swift) / image	1s
	1h 43m 43s

Provide feedback