verify all git artifacts using sigstore/gitsign

As a security minded individual, I would like to ensure artifacts are signed before pulling them onto a fetchit system.

1) Would like to be able to provide a cosign public key to ensure that an image has been signed before running in an environment.

AC:
Verify a public key can be provided to verify images
Verify that if a public key is provided and the signature does not match the image will not start
Verify that if a public key is not provided images launch as planned

2) Or, I'd like to verify that all git commits being pulled in are verified https://github.com/sigstore/gitsign