fix: use cosign.pub for entire registry

[gmpinder]

Per discussions in Discord, I don't think this would work with the current way we have image refs being created in GitHub. Might have to wait for the trust command feature to better support rebasing between images.