feat: npmjs sigstore tuf: use ValidFor.Start and ValidFor.End #757
Description
The work in #731 retrieves the latest the signing key from the TUF root. There is metadata for a ValidFor.Start, and in the future there may be a ValidFor.End.
Consider ensuring that the current timestamp is between the start and end timestamps.