signer API: review exceptions specifically for Key.verify_signature

[lukpueh]

signer API: review exceptions specifically for Key.verify_signature

[lukpueh]

Some thoughts about requirements:

• Applications should be able to use a threshold verification algorithm, which only cares for valid signatures.
• This means, applications should be able to successfully parse metadata (using Key.from_dict), and attempt verification (using key.verify_signature), even with keys with unknown or unsupported keytypes or schemes.
• Known keytypes and schemes with invalid formats should fail parsing or verification.

[lukpueh]

• Applications should be able to use a threshold verification algorithm, which only cares for valid signatures.
• This means, applications should be able to successfully parse metadata (using Key.from_dict), and attempt verification (using key.verify_signature), even with keys with unknown or unsupported keytypes or schemes.

Currently, Key.from_dict raises an error on unknown keytypes and schemes. If the application just catches the error and skips the unknown key, it will break any signature verification of the container metadata, if it depends on canonicalisation. Which is the default for tuf and in-toto.