Use an in memory timestamping key

[asraa]

Signed-off-by: Asra Ali asraa@google.com

• Generates an in-memory timestamping key. The rekor signer creates a timestamping certificate for this key.
• If a timestamp_chain is loaded in, then this is used for the timestamping chain. It's leaf must be a certificate for the rekor signer.
• Otherwise, a self-signed in-memory CA is created.

Tested with both in-memory signer (no chain) and a timestamp_chain loaded in authorizing the rekor signer as a CA to issue timestamping certificates

[asraa]

@dlorenc

[asraa]

Thanks for the check! Confirmed it work in the cases:

• Load up a gcpkms signer and a timestamping cert chain -> uses the signer to create a TSA cert, and verifies with the chain provided (the cert chain must authorize the signer to be a CA)
• Load up a gcpkms signer and no timestamping cert chain -> creates an in-memory root CA which creates the TSA cert
• Load up an in-memory signer and no timestamping cert chain -> creates an in-memory root CA which creates the TSA cert
• If you load up an in-memory signer and a timestamping cert chain -> you will fail on start up because it won't verify the chain