Support Cosign verification with multiple keys

[yizha1]

What would you like to be added?

Currently, users can only configure one key for Cosign verification. There are scenarios where multiple keys are used for signing during the process of distributing container images, thus images are signed with multiple keys by different parties throughout the process, as a result, multiple signatures are generated and associated with container images. The keys could be self-managed keys or keys stored in multiple KMSs, such as AKV. This issue is to ask for support of Cosign verification with multiple keys.

• Users can configure multiple self-managed keys
• Users can configure multiples keys that stored in different KMS, such as AKV
• To achieve an overall successful validation, all signatures produced with multiple keys must be validated.

NOTE: If multiple signatures are generated by one key, the overall validation passes as long as at least one signature passes validation

Anything else you would like to add?

No response

Are you willing to submit PRs to contribute to this feature?

• Yes, I am willing to implement it.