TUF Delegations to Fulcio identities

[mnm678]

We can use the TUF root of trust to create namespaced delegations to Fulcio identities for particular artifacts. This would allow verifiers to determine which identity should be signing a given artifact.

To do so, we need a couple of things:

• delegation from the TUF root of trust to a role that will create these delegations (related to Delegation tracking issue #398)
• implementation of the Fulcio TAP that allows TUF delegations to Fulcio identities in go-tuf (TAP for TUF developer key management theupdateframework/taps#141)
• process for automatically verifying that an identity owns an artifact (see Transparent TUF)

[jku]

tuf-on-ci itself supports this already (its is experimental since very few clients support the TAP) so repositories like this can be setup in minutes right now...

However

• I suggest that we don't use this feature in root-signing
• The specification and client support required is going to take effort that is not really a root-signing issue anyway

based on this I'm closing.

[jku]

(please reopen if I've misunderstood anything)