Feature: support standard public keys (with and without transparency logs)

[dlorenc]

Description

Signing with a fixed key is still sometimes the best answer, depending on availability and privacy tradeoffs. The transparency log was designed to help make this even safer.

I think sget should support verification based on public keys, in addition to the other methods. Rekor checks should be an option here too!

[lukehinds]

makes sense, the main driver for keyless policy was for a no-brainer UX, but a pub key could be utlised as well.

for rekor there is a certain amount in sigstore-rs, I will try and take a look

https://github.com/sigstore/sigstore-rs/issues/16