6832fba492
Ensure the bundle signature and key are compared to the rekor entry every time, not just when trusted root is used. Sigstore-go's VerifySET does not do this full comparison, we'd need to go through one of the more comprehensive Verify* functions to get this level of verification from the library. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com> Co-authored-by: Colleen Murphy <cmurphy@users.noreply.github.com>