SigstoreSigner: public key should match signer

[lukpueh]

SigstoreSigner: public key should match signer

[jku]

if you're just looking for something to start with, #498 or #512 might be good

[jku]

it's unfortunately not 100% clear what the right path is:

• the info we want to verify is in the token...
• but the token is also sort of a black box that we as users of sigstore-python just should not need to parse

I'm still hoping that sisgtore-python would add some functionality to make this easier (such as being able to call issuer.identity_token() with arguments issuer / identity), sigstore/sigstore-python#567 but it is not clear if that will happen or not

[ckilcoin]

Hi Lukas, I am interested in working on this issue as a first task to get more involved in the Secure Systems Lab. Do you think it would be good introductory work for the project?