Support for PGP signatures

> Supporting GPG signatures is good for backwards compatibility but do we want to put that implementation burden on new implementations, which this will be? Food for thought.

The availability of PGP trust anchors is the main reason PyPI removed signatures from their repository: https://blog.pypi.org/posts/2023-05-23-removing-pgp/
On the other hand Maven Central requires PGP signatures for all published artifacts: https://central.sonatype.org/publish/requirements/

I don't think we should require the support of the OpenPGP format, but we might allow users to publish the public keys as X509 certificates and mark their usage as "Maven only", "PyPI only", etc.
The main use case would be to allow a user to verify the authenticity of the sub-components of an _ACME Miracle Server_ product. If Dependency Track can verify that a sub-component comes from an upstream supplier **without modifications**, it can provide security alerts **before** those alerts propagate to the _ACME_ API server.

_Originally posted by @ppkarwasz in https://github.com/CycloneDX/transparency-exchange-api/issues/21#issuecomment-2268503713_