Feature suggestion: Adding Sigstore support to the standard

[Sigstore](https://www.sigstore.dev) exists to verify whether a deployed dependency was signed by the author. Detecting whether a detected dependency was signed by Sigstore would allow downstream tools such as DependencyTrack to expose to its users their coverage of signed dependencies.