Allow keyed signing without writing to disk

[znewman01]

Right now, cosign sign --key takes a file or a KMS URL. A file isn't 100% ideal for CI, since you don't want to chance other build steps (which run with the same permissions usually) to be able to read it.

Specifically, consider the scenario where the private key comes into GitHub actions as a secret. It'll be exposed to the build step as an environment variable.

Two possible solutions come to mind:

1. Add an env:// handler for cosign keys cosign sign --key env://MY_ENV_VAR
2. Let --key take - to indicate STDIN. This may cause issues because cosign sign sometimes prompts. Maybe cosign sign --key - --force would work here.

[dlorenc]

i like env://

[jeff-mccoy]

This is a great option for avoiding on-disk creds in CI, ironically for our DoD customers we are now having to work the opposite direction thanks to https://stigviewer.com/stig/kubernetes/2021-04-14/finding/V-242415. Basically the DoD believes env var secrets are evil now 😭. We ended up using KMS for CI.

[znewman01]

i like env://

Great, draft PR #1794 does that. I need to wait for sigstore/sigstore#407 to get merged first.