cnabio / signy

Go implementation for CNAB content trust verification using TUF, Notary, and in-toto
MIT License
31 stars 11 forks source link

Allow users to BYOK #71

Open trishankatdatadog opened 4 years ago

trishankatdatadog commented 4 years ago

Description

signy should allow users to bring their own keys (BYOK).

Current behavior

signy assumes users will always push timestamp and snapshot to the Notary signers, and that users will reuse a single pair of root and targets keys across bundles.

Expected behaviour

signy should be flexible enough to allow users to override the above default behaviour by specifying their own keys to use.