Move the ssh signing/verification utilities to sigstore from rekor.

[dlorenc]

SSH signing has started to gain momentum with support in git! We have an implementation
in rekor that works, but it probably doesn't belong there. Let's move it here and realign
it with our sigstore signing APIs.

Signed-off-by: Dan Lorenc lorenc.d@gmail.com

Summary

Ticket Link

Fixes

Release Note

[bobcallaway]

I like this (and am supportive of moving over the rest of rekor/pki where it makes sense). I think we would still need a way to generate a canonicalized version of a public key and signature to persist in the log (which is what is missing in sigstore/sigstore right now.

[dlorenc]

I like this (and am supportive of moving over the rest of rekor/pki where it makes sense). I think we would still need a way to generate a canonicalized version of a public key and signature to persist in the log (which is what is missing in sigstore/sigstore right now.

Yeah I don't think we need to move allllll of it over. This one was particularly ripe for a move though because we don't even use the Sign function other than for tests of Verify.

[dekkagaijin]

LGTM FWIW

[lukehinds]

also lgtm, do we need to coordinate a removal PR from rekor?

[dlorenc]

Thanks for the reminders - cleaned up the last TODOs.

[dlorenc]

PTAL, should be good now!