for multi-platform manifest, it puts the attestation on the actual (amd64) image instead of its manifest
mentioned in commit 63f6611d