Breaking Change: image sign annotations from dev.cosignproject.cosign to dev.sigstore.cosign

[Dentrax]

Description

In layout/index.go and signature/layer.go we are using dev.cosignproject.cosign key. I think it would be nice to change these names as we are already using dev.sigstore.cosign for certkey, chainkey and BundleKey.

Migration

This would be breaking change. I'm not sure what is the right way to handle this, but the first thing I thought is that we can check for dev.cosignproject.cosign label at first and if not exist falling back to dev.sigstore.cosign for second check (or send 2 reqs concurrently) would solve the problem. (We can reverse the order after a few new version released) That would be a workaround because we are not pinning cosign's version in labels. That said, we do not know which version of cosign the user is using.

[dlorenc]

+1 for supporting both for some time.

I'm not sure we can make the change though without a major version bump, since signatures generated with one version need to validate in previous ones.