cosign load does ignore --allow-http-registry

[cck1860]

When trying to load cosigned images by using cosign load to a http-only registry, I observed that the flag --allow-http-registry is ignored.

A command like cosign load -d --allow-http-registry --dir /tmp/extract/ xxx.yyy.svc:5000/test/myalpine:latest fails with the error message

2025/03/25 15:08:01 <-- tls: first record does not look like a TLS handshake GET https://xxx.yyy.svc:5000/v2/ (13.223274ms)
Error: remote write: Get "https://xxx.yyy.svc:5000/v2/": http: server gave HTTP response to HTTPS client
error during command execution: remote write: Get "https://xxx.yyy.svc:5000/v2/": http: server gave HTTP response to HTTPS client

which makes me think that the flag is ignored.

Version

cosign version

cosign: A tool for Container Signing, Verification and Storage in an OCI registry.

GitVersion: v2.4.3
GitCommit: 6a7abbf
GitTreeState: clean
BuildDate: 2025-02-19T19:34:52Z
GoVersion: go1.23.6
Compiler: gc
Platform: linux/amd64