Howto rule out a MITM attack after re-importing the image-as-tarball?

[praiskup]

For Hermetic builds in Mock, we want to

1. "podman pull" an image in an online mode, work with that image certain way, and remember the image digest
2. export the image-as-tarball, for further work in an offline mode
3. re-import the image-as-tarball, and confirm that the digest hasn't changed (detect potential man-in-the-middle)

The image {{ .Digest }} though changes after re-import.

We were told that {{ .RootFS.Layers }} + {{ .Config }} might be a better alternative (thanks @nalind). Seems like a good start, does anyone think that we should include any other field? Can we rely on this data and implement our own checksum? Could we have a new metadata field for this purpose in podman image inspect in the future?