fix: require registry admin to manage provider signing keys (#1290)