Example policy with 2 signatures from 2 different parties

etc-containers-policy.json

{
    "default": [{"type": "reject"}],
    "transports": {
        "docker": {
            "registry.example.com:5000/big/app": [
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
                    "keyPath": "/path/to/foo.gpg" /* assumes you've already downloaded foo pubkey to host */
                },
                {
                    "type": "signedBy",
                    "keyType": "GPGKeys",
                    "keyPath": "/path/to/example.gpg" /* assumes you've already downloaded foo pubkey to host */
                }
            ]
        }
    }
}

etc-containers-registries.d-registry.example.com.yaml

docker:
   registry.example.com:5000:
    sigstore: http://sigstore.example.com/signatures/