Consider supporting sigstore

[theseer]

It might be very interesting to integrate support for sigstore, once it's more ready.

Quoting https://sigstore.dev:

What is the current status of the project

As of time of writing [24/06/2021] we have a working transparency log (rekor), that is fully operation as a standalone service. Files are available to run this in GKE. Work is now underway to mature the WebPKI (fuclio) and develop client tools for various package managers and upstream communities