Description of problem: With Barbican enabled for openstack as image signing Service, at the moment it is not possible to create a signed image snapshot from a VM which was originally created from a signed image. This is because of the config option "non_inheritable_image_properties" which doesn't propagate signature related metadata of original image to a snapshot image of the virtual machine.
> So, in order to create a VM, this snapshot has to be downloaded, signed and then uploaded to glance which is not a straight-forward approach. Yes, this seems like the current approach, see also https://bugzilla.redhat.com/show_bug.cgi?id=1969888#c30 . This involves nova, glance, barbican and cursive. I'm not sure how hard it would be to improve the process. I am going to retarget this to Nova because everything starts with the user creating a snapshot, but this might involve changes in multiple components.