BootstrapPGPFromGCP creates a new PGP public key with a hardcoded cert-manager identity, signed using a named GCP KMS key.

CertManagerManifests takes a path to a cert-manager-manifests.tar.gz file, loads it into memory and signs anything inside the archive which is signable; currently, the helm chart located at "deploy/chart/cert-manager.tgz" is signed, and a signature "deploy/chart/cert-manager.tgz.prov" will be added.

HelmChart signs a given packaged helm chart (usually a .tgz file) using the given KMS key, returning the human-readable signature bytes.

NewGCPKMSKey parses and validates an input KMS key.

GCPKMSKey holds a GCP KMS key, easily serializable to either GCP format ('cryptoKeyVersions') or cosign format ('versions').

PGPArmoredBlock is an ASCII-armored PGP key block.