sigstore Timestamp Authority Vulnerabilities