[kapilvt]

closer to TLS CA setup with ephemeral certificates, a public log of issuance, then pgp individual trust circles and semi static keys.

https://www.sigstore.dev/how-it-works