Create sign/verify helpers for sigstore

[ojarjur]

We should create sign/verify helpers that integrate with Sigstore.

At a minimum I would like to have some support for keyless signing similar to what https://github.com/wlynch/smimecosign provides for git.

Additionally, it might be good to have any other sign/verify helpers (such as the ones for SSH keys) write entries to the Rekor transparency log that can be later verified.