Remove non-GA APIs from experimental sign-blob verification flow

[patflynn]

Description

This issue is to ensure we remove the use of /api/v1/index/retrieve from cosign verify-blob flow before we launch this version of the command to stable.

Another option is to get Rekor to commit to supporting the API.

[asraa]

I think there were some users who were still relying on this flow. I agree, we discussed this at some point during the cosign blob verification outputs. I can put out a quick PR to do that, we should label in release notes HEAVILY.

For e.g. here were users failing when that endpoint broke: #1406

[haydentherapper]

We can remove it for 2.0. But it would be worth understanding what the customer workflows are and if we can support those in other ways

[asraa]

GoReleaser updated docs to pass in the signing cert, at least that is done.