Docker Sign an Image with an existing Certificate
This documentation indicates that it is possible to add collaborators by trusting their key and that it is also possible to revoke access.

Having said that, the answer to:


  either an image is signed or it is not, but it is not qualified by who
  performed the signing


that it is possible to check who signed the image if every collaborator creates their own key and each key is trusted individually.

As notary and dtr were already mentioned, an alternative is Portus. Portus is able to restrict access to docker images, e.g. some users are only allowed to view images, while others may pull them. It is possible to revoke access as well.