Rewriting the workflow to call out to sub-sections

The TUF spec is written in a prose form, especially the update workflow. One of the challenges with this that we have duplicated paragraphs that describe essentially the same thing. For example:

2.1. Check signatures. The new timestamp metadata file must have been signed by a threshold of keys specified in the trusted root metadata file. If the new timestamp metadata file is not properly signed, discard it, abort the update cycle, and report the signature failure.
...
3.2. Check signatures. The new snapshot metadata file MUST have been signed by a threshold of keys specified in the trusted root metadata file. If the new snapshot metadata file is not signed as required, discard it, abort the update cycle, and report the signature failure.
...
4.2. Check for an arbitrary software attack. The new targets metadata file MUST have been signed by a threshold of keys specified in the trusted root metadata file. If the new targets metadata file is not signed as required, discard it, abort the update cycle, and report the failure.

Note each section has a slight change from each other, which happens as small corrections happen in one, but we forget to fix it in the others. Instead, I think it's worth considering restructuring the workflow (and possibly the rest of the doc) to be more in the style of the whatwg specs (such as https://url.spec.whatwg.org/), where we call out to sub-sections to implement these major steps. For example, parsing the signatures could be written as:

2.1 Check the signatures.

1. Let sig_result be the result of check signatures with metadata being the new timestamp metadata, role being timestamp, and root being the trusted root metadata.
2. If sig_result is failure, then return failure.
   ...

Check signatures:

The signature checker takes a metadata metadata, and a role type role, and a root metadata.

1. Canonicalize the metadata as canonical_metadata_bytes.
2. For each signature sig in the metadata`'s signature field:
   1. If sig is in a processed_sig set, skip the signature.
   2. If it signed canonical_metadata_bytes. Increment a threshold counter.
3. If threshold counter is less than role's threshold in the root metadata, return failure.

I think this sort of thing would really be helpful in making sure we don't make subtle copy-paste errors when changing the spec, and make it much easier on a client library to implement the spec correctly.

Start by reading the TUF update workflow and compare the repeated signature-check sections described in the issue. Review the WHATWG-style examples linked in the proposal, then map which workflow steps could call shared subsections. The work is done when the specification avoids duplicated procedures while preserving each step’s required behavior and remains implementable by client libraries.