ClusterImagePolicy defines the images that go through verification and the authorities used for verification.

This references a public verification key stored in a secret in the cosign-system namespace.

RFC3161Timestamp specifies the URL to a RFC3161 time-stamping server that holds the time-stamped verification for the signature.