Confidential containers allow you to sign the enclave code but not the docker container itself. With enclave code (which is typically your core application code in Java, Python etc.) signing you can verify through attestation the MRSIGNER details of the enclave code before you can trust the code and the execution environment through attestation flow.