Gather SigStore signatures where possible.

[ctron]

I'd like to understand what idea we have around this, what we want, and what we want to offer. I think there's also the topic of "classic signatures", that we have, and ignore for the moment.

I could imagine that we:

• Ingest signatures alongside the ingested document (1 -> n) ­– classic signatures
• Discover signatures after a document was ingested (1 -> n) – sigstore
• Validate signatures (what happens is that fails?)
• Allow users to set up trust anchors for validating signatures