Document PGP Signature Verification on Installation Docs

[maltfield]

Description

Currently it is not clear how to verify the authenticity or cryptographic integrity of the sigstore releases from github.com because there is no mention of it in the official installation docs:

• https://docs.sigstore.dev/cosign/system_config/installation/

This makes it hard for sigstore users to safely obtain the sigstore software, and it introduces them (and potentially future things they try to verify with sigstore's cli tools) to watering hole attacks.

Steps to Reproduce

1. Go to the install docs https://docs.sigstore.dev/cosign/system_config/installation/
2. Look for info on how to verify the signature of the release using PGP
3. ???
4. Get confused and open ticket

Expected behavior: [What you expected to happen]

A few things are expected:

1. I should be able to download the sigstore PGP key out-of-band from popular third-party keyservers (eg https://keys.openpgp.org/)
2. I should be able to download a cryptographic signature of the release (or, better, the releases' digest file, such as a SHA256SUMS.asc file) along with the release itself
3. The downloads page itself should include a link to the documentation page that describes how to do the above two steps

Actual behavior: [What actually happened]

There's just literally no information on verifying downloads with PGP, and it appears that it is not possible to do so.

[maltfield]

Note: what is documented is how to use tuf-client, but this is a chicken-and-egg problem.

The installation guide currently tells users to use go install to install a go module (which, by the way, is archived and says not to use it). But go install does not securely obtain software using cryptographic signatures -- unlike something like apt, where users can securely download gpg.

Note that this ticket indicates that sigstore is signed with PGP, but this doesn't appear to be documented.

The solution to this ticket is to document how to verify the signature on the release of sigstore using gpg -- not using tuf-client

[maltfield]

For best-practices, see also:

1. https://infra.apache.org/release-signing
2. https://docs.opendev.org/opendev/system-config/latest/signing.html
3. https://wiki.debian.org/Subkeys
4. https://riseup.net/en/security/message-security/openpgp/best-practices

[maltfield]

For the documentation required to fix this issue, please see the following "verifying this release" documentation from other open-source projects as a template

1. https://www.apache.org/info/verification.html#CheckingSignatures
2. https://docs.featherwallet.org/guides/linux#verifying-the-download-optional
3. https://support.torproject.org/tbb/how-to-verify-signature/
4. https://ubuntu.com/tutorials/how-to-verify-ubuntu
5. https://tails.net/install/expert/index.en.html#verify-key
6. https://calyxos.org/install/verify/#additional-verification