How about a federated system for sharing “known safe” image attestations? That way, the trust list is something managed locally by each participating instance.

Edit: thinking about it some more, a federated image classification system would allow some instances to be more strict than others.