Signed Certificate Timestamp with Long-lived Keys

[jkjell]

Question
When signing an image with the command below:
cosign sign --key cosign.key <IMAGE> --tlog-upload=false

it's required to use this command to verify it (in a restricted environment, i.e. no access to TUF root CDN):
cosign verify --key cosign.pub <IMAGE> --insecure-ignore-tlog --insecure-ignore-sct

even though no timestamp will be added. This is related to this Slack thread.

Should it be necessary to ignore the "Signed Certificate Timestamp" when not signing with a certificate? Are their valid use-cases for a timestamp with a long-lived key?

[haydentherapper]

If you only specify a key, you should not need to specify the SCT flag. That would be a bug we can fix.