Verifier does not enforce WithSignedCertificateTimestamps when the bundle is signed with a public key

[codysoyland]

Description

func WithSignedCertificateTimestamps(threshold int) VerifierOption is used to specify a required threshold of SCTs present in the leaf certificate. This threshold is not enforced when the bundle is signed with a plain public key instead of a certificate. The check for SCTs is conditioned on the presence of a certificate. It should be an error to verify a bundle with a public key when the verifier is configured to require SCTs.

Version

[Horiodino]

/assign I’d like to work on this if it’s still available!