TUF: GetRekorPubs should be used in CheckOpts, like Fulcio CheckOpts.Roots

[asraa]

Description

This will require a change to upstream sigstore/sigstore and then we can call the function to get rekor pubs from sigstore's root.

cc @imjasonh @haydentherapper

[imjasonh]

Having a method to determine the correct Rekor pubs sounds generally useful outside of cosign. Can we add this to sigstore/sigstore and just call it from cosign?

Or, if we need to have a method in cosign to do it, can we make it unexported or in an internal package, so folks are steered toward the sigstore/sigstore equivalent?

[asraa]

Having a method to determine the correct Rekor pubs sounds generally useful outside of cosign. Can we add this to sigstore/sigstore and just call it from cosign?

That's the plan