this should be agnostic of the provenance of the signature (lookaside, cosign signature tag, later oci 1.1 referrer)

rhn-engineering-mitr, can we take some time to discuss how to achieve this/contribute to this?
We might also want to spend some time to see if we want to copy signatures when copying from/to oci://... (this sounds to me like an optional from the oc-mirror perspective, but we might want to revisit this for the IBM use case)