Add support for timestamping signatures with TSAs configured in layout

[mikhailswift]

We need to add an additional field on each signature that allows us to embed signature of that signature from permitted time stamping authorities.

Word soup, I know.

Basically we need to send a signature we generate of the in-toto link metadata to some time stamping authority to ensure we're creating signatures within a key's valid lifetime. It may look something like:

"signatures": [
  {
    "keyid": "434f5f16788e49f4e405b63556cf5e7772c8fdc438ee381736c90804f648b304",
    "sig": "304402206e012377e2a661df4be391b4731c5cf92cb9b642509f441d284a15279bf3f8500220027697136b944aeba64578a4ed74af549358b5527a64e500f775b3bdbddfa3ce",
    "cert": "-----BEGIN CERTIFICATE-----\nMIIB7TCCAZSgAwIBAgIQZqgm6hMgv9qbQPkt+owbhDAKBggqhkjOPQQDAjAdMQsw\nCQYDVQQGEwJVUzEOMAwGA1UEChMFU1BJUkUwHhcNMjEwMzAzMTk0NzU5WhcNMjEw\nNDAyMTk0MjM0WjAdMQswCQYDVQQGEwJVUzEOMAwGA1UEChMFU1BJUkUwWTATBgcq\nhkjOPQIBBggqhkjOPQMBBwNCAASlOE5J2ARBjwQfM255aSPQ7p85qRyrGnuTVbhl\n0zX0P+Bswl8xPOLdIZq93ejAM2nEWv29u1I0f2n0ImU6FNnjo4G1MIGyMA4GA1Ud\nDwEB/wQEAwIDqDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0T\nAQH/BAIwADAdBgNVHQ4EFgQUe1TrPdjzCB7Qxq5vexEAlXOoCMYwHwYDVR0jBBgw\nFoAU0dLhyMLPbujKf9nW7j/7qUheP7IwMwYDVR0RBCwwKoYoc3BpZmZlOi8vc3Bp\ncmUuYm94Ym9hdC5pby9pbnRvdG8tYnVpbGRlcjAKBggqhkjOPQQDAgNHADBEAiB0\nuAsAE9W2xh2OclRFkf8MWaZvcoyeEGM1ppX7hMi7CgIgcXOBpm9jxGkFPUgJpwIU\nrGtQoIwPHAEtmC4hS5z3VFc=\n-----END CERTIFICATE-----\n",
    "timestamps": {
      "<TSA PUBLIC KEY ID">: {
        "type": "RFC3161",
         ...
      },
    }
  }
]

The shape of the timestamp object could differ based upon which standard was used to generate the timestamp. For instance RFC3161, X9.95, ISO/IEC 18014. See the below link for example.

https://en.wikipedia.org/wiki/Trusted_timestamping

Similarly the layout will need an additional field of trusted timestamp authorities' public keys. This may look similar to the existing "keys" field in the layout.

At verification time we will want to test each of the timestamps to ensure the key was valid when it was used to create the signature and ensure we trust the TSA used as defined by the layout.

At in-toto run time we need to take in a list of TSAs to use to generate timestamps for any signatures generated. This is tricky as not all timestamp specifications define transport methods. Currently I think we can just take in http endpoints that we can post a TSQ to, similar to how freetsa.org works: https://www.freetsa.org/index_en.php

In cases where a signature does not have any timestamps associated with it we will want to maintain the current in-toto behavior and only consider it valid if the signing key is valid at time of verification.

[mikhailswift]

We'll want to start drafting an ITE for this functionality to build upon our work here. This should be separate from ITE7 so we can introduce this incrementally.

[colek42]

Relevant discussion - https://github.com/notaryproject/notaryproject/issues/82 https://hackmd.io/9mc_kvXoRc2GmjOnz0_eYA