There's a few reasons why sigstore-rs is not yet tested (is experimental, does not support staging, does not support configuring TUF urls, the "bundle" example that we could use has not been released yet) but we keep breaking sigstore-rs (#1431) so we should still do it.

I will push a draft PR. It's a little tricky to test right now.