Is there a best-practise for a fallback harbor with trust?

[axi92]

We have 2 harbor in production. 1 is live and the other not.
When I push and sign new images I do it on the live one first and then manipulate the dns entry to point to the second one and do the same.

Is there a better way to do this?

Would it be possible to clone the vm (first instance) or are there some complications with that? (except for ssh host keys, but I can regenerate them)