Encrypting docker images (end to end); transporting over offline channels
Google Container Registry is a potential option.


Registry is private
Image layers are stored on a Google Cloud Storage bucket, which is encrypted by Google (RSA) and can be additionally encrypted with a client key (RSA)
Access control is granular down to each individual object stored on GCS bucket
Client-side authentication is enforced via oauth2. Clients configure docker to use the google cloud sdk as a credentials manager
Images are pulled via ssl connections


The fact that the registry is part of Google's Cloud Platform also means you can build up to some other interesting things. For example, you could set up a VM to serve as reverse-proxy and set up the GCP firewall to only allow 443 from a certain set of IPs (like your clients' offices).