message has been deleted

Is there a way to pin the signing keys for the base image and ensure any packages installed by the module are verified? I'd like to verify all the packages that I can.