sign: Plumb TUF root into sign path for verification

[asraa]

Description

@znewman01 brings this up in this comment: #2393 (comment)

Currently, we have:

1. TUF root being internally called inside VerifySCT for CT pubkey, which is called on the sign path.
2. doUpload using a Rekor pubkey (from the API in that PR) to verify the uploaded response
3. NO Fulcio cert chain validation on the sign path.

All three of these should be addressed, maybe by adding a new struct into either the signopts or keyopts