orchestrate

type Options struct {
	ArtifactDigest         string
	Repository             string
	CertIdentity           string
	CertIssuer             string
	SourceRef              string
	BlobPaths              []string
	Quiet                  bool
	CertIdentityValidation *certid.Options
	// pre-resolved signer allowlist; if empty it is resolved once from
	// CertIdentity + CertIdentityValidation before verifying.
	AcceptedIdentities []string
}