Use rekor signedEntryTimestamp if present

[dlorenc]

We should figure out where to store these in the OCI registry (an annotation?), update the SPEC, start including them and then start looking for them during verification.

We can always use one of these if present (no opt-in/out needed, and do a force check of the log (--verify-inclusion)? as opt-in.

This should mean we can eliminate read operations from experimental for now (moving them to default). We still need a way to get the write calls out of experimental.

[priyawadhwa]

Yah I think we can store the SET as part of the "bundle" annotation (which will probably end up including other stuff like certs for keyless mode).

[dlorenc]

Is this done now?

[priyawadhwa]

Yup!