A reproduction of the current sigstore@4.0.0 (and earlier) behavior working with issuer.enforce.dev - View it on GitHub