docs(readme): add provenance

Author: thomasleplus

README.md

@@ -129,6 +129,15 @@ docker buildx imagetools inspect leplusorg/pgp-verify-jar --format '{{ json (ind
 
 Replace `linux/amd64` by the desired platform (`linux/amd64`, `linux/arm64` etc.).
 
+## Provenance
+
+To get the provenance for the latest image (in JSON format), use the
+following command:
+
+```bash
+docker buildx imagetools inspect leplusorg/pgp-verify-jar --format '{{ json .Provenance }}'
+```
+
 ## Sigstore
 
 [Sigstore](https://docs.sigstore.dev) is trying to improve supply