Unable to sign using a secured certificate

I currently use an EV cert hosted on Azure KeyVault, and I can't use this plugin to use it.
I'm not 100% sure if it's because the key is "unexportable" (mandatory by the EV nature) or if it's just the internal method `key.CertificateChain` which is just not generic.
This method seems retrive the public certificate chain in a secret... I don't understand why ?

In parallel I tried to use `az keyvault certificate download --encoding PEM` to store the leaf cert in `notation cert add` but it seems useless.

In my opinion, to get the full cert chain, we should not rely on Azure KeyVaut. KeyVault should just export the public leaf cert part, then the plugin should check the notation certs visible in `notation cert ls`, and fallback on the OS cert store, to find the issuers chained.

Exemple of current error :
```
notation sign --key My-Key-Name docker.io/library/golang:1.16
Warning: Always sign the artifact using digest(`@sha256:...`) rather than a tag(`:1.16`) because tags are mutable and a tag reference can point to a different artifact than the one signed.
Resolved artifact tag `1.16` to digest `sha256:5f6a4662de3efc6d6bb812d02e9de3d8698eea16b8eb7281f03e6f3e8383018e` before signing.
Error: certificate-chain is invalid, crypto/rsa: verification error
```

By the way there is a lack of logging in this module in case of error.
Adding some debug traces in case of error, using the standard flag `--debug` could be useful.
Example : `notation sign --key My-Key-Name docker.io/library/golang:1.16 --debug`