sigstore-go fails to check signature timestamps against a signing key's validity period (CVE-2026-54787) | HOL Guard CVE