Repository: sigstore/fulcio
Pull request #1754 (2024-08-05 02:20:38)

Bump the all group across 1 directory with 4 updates
Bumps the all group with 3 updates in the /hack/tools directory: [github.com/googleapis/api-linter](https://github.com/googleapis/api-linter), [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) and [google.golang.org/grpc/cmd/protoc-gen-go-grpc](https://github.com/grpc/grpc-go).

Updates `github.com/googleapis/api-linter` from 1.65.0 to 1.67.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/api-linter/releases">github.com/googleapis/api-linter's releases</a>.</em></p>
<blockquote>
<h2>v1.67.1</h2>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.67.0...v1.67.1">1.67.1</a> (2024-07-31)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>AIP-123:</strong> skip resource-pattern-plural when there is no plural (<a href="https://redirect.github.com/googleapis/api-linter/issues/1409">#1409</a>) (<a href="https://github.com/googleapis/api-linter/commit/93a601d92adbeb0c17fa8724212ee344f934a4aa">93a601d</a>)</li>
</ul>
<h2>v1.67.0</h2>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.66.2...v1.67.0">1.67.0</a> (2024-07-26)</h2>
<h3>Features</h3>
<ul>
<li><strong>AIP-123:</strong> enforce singular as ID segment (<a href="https://redirect.github.com/googleapis/api-linter/issues/1403">#1403</a>) (<a href="https://github.com/googleapis/api-linter/commit/088ec196da93a9338b2abf60469cb55ecec5c34d">088ec19</a>)</li>
<li><strong>AIP-123:</strong> resource collection matches plural (<a href="https://redirect.github.com/googleapis/api-linter/issues/1408">#1408</a>) (<a href="https://github.com/googleapis/api-linter/commit/9025d3d674df9f918483decc0f559f168737ee69">9025d3d</a>)</li>
<li><strong>AIP-134:</strong> update_mask must be OPTIONAL (<a href="https://redirect.github.com/googleapis/api-linter/issues/1394">#1394</a>) (<a href="https://github.com/googleapis/api-linter/commit/9fc0d05f3d89905ea7d3b22c9b44fbfa79edac07">9fc0d05</a>)</li>
<li><strong>AIP-217:</strong> add various rules for return_partial_success support (<a href="https://redirect.github.com/googleapis/api-linter/issues/1406">#1406</a>) (<a href="https://github.com/googleapis/api-linter/commit/cf4ba1284bbab151275e7dedf291ffea0e488b1c">cf4ba12</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>docs typo (<a href="https://redirect.github.com/googleapis/api-linter/issues/1401">#1401</a>) (<a href="https://github.com/googleapis/api-linter/commit/4acf04c6829ffe7f57cf2997c4f9ccc956de9274">4acf04c</a>)</li>
</ul>
<h2>v1.66.2</h2>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.66.1...v1.66.2">1.66.2</a> (2024-06-04)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>aip-130:</strong> identify standard and custom methods (<a href="https://redirect.github.com/googleapis/api-linter/issues/1396">#1396</a>) (<a href="https://github.com/googleapis/api-linter/commit/be41d72e50032b45f4263779e638fc8ec0ff9013">be41d72</a>)</li>
</ul>
<h2>v1.66.1</h2>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.66.0...v1.66.1">1.66.1</a> (2024-05-23)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>AIP-136:</strong> handle LRO response names (<a href="https://redirect.github.com/googleapis/api-linter/issues/1391">#1391</a>) (<a href="https://github.com/googleapis/api-linter/commit/ec79f5392829fc58a44f577dce55a936ea112988">ec79f53</a>)</li>
</ul>
<h2>v1.66.0</h2>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.65.2...v1.66.0">1.66.0</a> (2024-05-17)</h2>
<h3>Features</h3>
<ul>
<li><strong>AIP-136:</strong> request message name (<a href="https://redirect.github.com/googleapis/api-linter/issues/1386">#1386</a>) (<a href="https://github.com/googleapis/api-linter/commit/46a6e43d1d6bb6a6e79131866f16f0b1dfd2e326">46a6e43</a>)</li>
<li><strong>aip-136:</strong> response message name (<a href="https://redirect.github.com/googleapis/api-linter/issues/1387">#1387</a>) (<a href="https://github.com/googleapis/api-linter/commit/9e43e3f1c98dfe716d4c8ede6fc213239425c6ef">9e43e3f</a>)</li>
</ul>
<h2>v1.65.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/googleapis/api-linter/blob/main/CHANGELOG.md">github.com/googleapis/api-linter's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.67.0...v1.67.1">1.67.1</a> (2024-07-31)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>AIP-123:</strong> skip resource-pattern-plural when there is no plural (<a href="https://redirect.github.com/googleapis/api-linter/issues/1409">#1409</a>) (<a href="https://github.com/googleapis/api-linter/commit/93a601d92adbeb0c17fa8724212ee344f934a4aa">93a601d</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.66.2...v1.67.0">1.67.0</a> (2024-07-26)</h2>
<h3>Features</h3>
<ul>
<li><strong>AIP-123:</strong> enforce singular as ID segment (<a href="https://redirect.github.com/googleapis/api-linter/issues/1403">#1403</a>) (<a href="https://github.com/googleapis/api-linter/commit/088ec196da93a9338b2abf60469cb55ecec5c34d">088ec19</a>)</li>
<li><strong>AIP-123:</strong> resource collection matches plural (<a href="https://redirect.github.com/googleapis/api-linter/issues/1408">#1408</a>) (<a href="https://github.com/googleapis/api-linter/commit/9025d3d674df9f918483decc0f559f168737ee69">9025d3d</a>)</li>
<li><strong>AIP-134:</strong> update_mask must be OPTIONAL (<a href="https://redirect.github.com/googleapis/api-linter/issues/1394">#1394</a>) (<a href="https://github.com/googleapis/api-linter/commit/9fc0d05f3d89905ea7d3b22c9b44fbfa79edac07">9fc0d05</a>)</li>
<li><strong>AIP-217:</strong> add various rules for return_partial_success support (<a href="https://redirect.github.com/googleapis/api-linter/issues/1406">#1406</a>) (<a href="https://github.com/googleapis/api-linter/commit/cf4ba1284bbab151275e7dedf291ffea0e488b1c">cf4ba12</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>docs typo (<a href="https://redirect.github.com/googleapis/api-linter/issues/1401">#1401</a>) (<a href="https://github.com/googleapis/api-linter/commit/4acf04c6829ffe7f57cf2997c4f9ccc956de9274">4acf04c</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.66.1...v1.66.2">1.66.2</a> (2024-06-04)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>aip-130:</strong> identify standard and custom methods (<a href="https://redirect.github.com/googleapis/api-linter/issues/1396">#1396</a>) (<a href="https://github.com/googleapis/api-linter/commit/be41d72e50032b45f4263779e638fc8ec0ff9013">be41d72</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.66.0...v1.66.1">1.66.1</a> (2024-05-23)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>AIP-136:</strong> handle LRO response names (<a href="https://redirect.github.com/googleapis/api-linter/issues/1391">#1391</a>) (<a href="https://github.com/googleapis/api-linter/commit/ec79f5392829fc58a44f577dce55a936ea112988">ec79f53</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.65.2...v1.66.0">1.66.0</a> (2024-05-17)</h2>
<h3>Features</h3>
<ul>
<li><strong>AIP-136:</strong> request message name (<a href="https://redirect.github.com/googleapis/api-linter/issues/1386">#1386</a>) (<a href="https://github.com/googleapis/api-linter/commit/46a6e43d1d6bb6a6e79131866f16f0b1dfd2e326">46a6e43</a>)</li>
<li><strong>aip-136:</strong> response message name (<a href="https://redirect.github.com/googleapis/api-linter/issues/1387">#1387</a>) (<a href="https://github.com/googleapis/api-linter/commit/9e43e3f1c98dfe716d4c8ede6fc213239425c6ef">9e43e3f</a>)</li>
</ul>
<h2><a href="https://github.com/googleapis/api-linter/compare/v1.65.1...v1.65.2">1.65.2</a> (2024-04-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>AIP-203:</strong> resource etag should not have behavior (<a href="https://redirect.github.com/googleapis/api-linter/issues/1376">#1376</a>) (<a href="https://github.com/googleapis/api-linter/commit/1c0f838941e064caa0eda046a5b4f1c2b7fb2788">1c0f838</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/googleapis/api-linter/commit/3085922804c346263138c2012855b48e8f062a31"><code>3085922</code></a> chore(main): release 1.67.1 (<a href="https://redirect.github.com/googleapis/api-linter/issues/1410">#1410</a>)</li>
<li><a href="https://github.com/googleapis/api-linter/commit/93a601d92adbeb0c17fa8724212ee344f934a4aa"><code>93a601d</code></a> fix(AIP-123): skip resource-pattern-plural when there is no plural (<a href="https://redirect.github.com/googleapis/api-linter/issues/1409">#1409</a>)</li>
<li><a href="https://github.com/googleapis/api-linter/commit/deb3983de47c2434161cad37b2c43a02675c92e2"><code>deb3983</code></a> chore(main): release 1.67.0 (<a href="https://redirect.github.com/googleapis/api-linter/issues/1402">#1402</a>)</li>
<li><a href="https://github.com/googleapis/api-linter/commit/9025d3d674df9f918483decc0f559f168737ee69"><code>9025d3d</code></a> feat(AIP-123): resource collection matches plural (<a href="https://redirect.github.com/googleapis/api-linter/issues/1408">#1408</a>)</li>
<li><a href="https://github.com/googleapis/api-linter/commit/cf4ba1284bbab151275e7dedf291ffea0e488b1c"><code>cf4ba12</code></a> feat(AIP-217): add various rules for return_partial_success support (<a href="https://redirect.github.com/googleapis/api-linter/issues/1406">#1406</a>)</li>
<li><a href="https://github.com/googleapis/api-linter/commit/088ec196da93a9338b2abf60469cb55ecec5c34d"><code>088ec19</code></a> feat(AIP-123): enforce singular as ID segment (<a href="https://redirect.github.com/googleapis/api-linter/issues/1403">#1403</a>)</li>
<li><a href="https://github.com/googleapis/api-linter/commit/026b645f90ee9b467a82d3575829e5b4a85f5476"><code>026b645</code></a> chore(deps): bump google.golang.org/grpc from 1.64.0 to 1.64.1 (<a href="https://redirect.github.com/googleapis/api-linter/issues/1405">#1405</a>)</li>
<li><a href="https://github.com/googleapis/api-linter/commit/9fc0d05f3d89905ea7d3b22c9b44fbfa79edac07"><code>9fc0d05</code></a> feat(AIP-134): update_mask must be OPTIONAL (<a href="https://redirect.github.com/googleapis/api-linter/issues/1394">#1394</a>)</li>
<li><a href="https://github.com/googleapis/api-linter/commit/4acf04c6829ffe7f57cf2997c4f9ccc956de9274"><code>4acf04c</code></a> fix: docs typo (<a href="https://redirect.github.com/googleapis/api-linter/issues/1401">#1401</a>)</li>
<li><a href="https://github.com/googleapis/api-linter/commit/d54434ee45b9d347cdb3d1a5162d34e6f68bc1ea"><code>d54434e</code></a> chore(main): release 1.66.2 (<a href="https://redirect.github.com/googleapis/api-linter/issues/1397">#1397</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/googleapis/api-linter/compare/v1.65.0...v1.67.1">compare view</a></li>
</ul>
</details>
<br />

Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.19.1 to 2.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/grpc-ecosystem/grpc-gateway/releases">github.com/grpc-ecosystem/grpc-gateway/v2's releases</a>.</em></p>
<blockquote>
<h2>v2.21.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: Use version info from runtime/debug:BuildInfo when installed by go build by <a href="https://github.com/MakDon"><code>@​MakDon</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4359">grpc-ecosystem/grpc-gateway#4359</a></li>
<li>feat: add mux middlewares and inject http pattern by <a href="https://github.com/nikitaksv"><code>@​nikitaksv</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4290">grpc-ecosystem/grpc-gateway#4290</a></li>
<li>Fixes <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/issues/3917">#3917</a>: Add package openapi naming strategy. by <a href="https://github.com/jgiles"><code>@​jgiles</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4372">grpc-ecosystem/grpc-gateway#4372</a></li>
<li>feat: use buildInfo.Main.Version as version when installed by go install by <a href="https://github.com/MakDon"><code>@​MakDon</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4390">grpc-ecosystem/grpc-gateway#4390</a></li>
<li>Add support for method's deprecated option by <a href="https://github.com/vajexal"><code>@​vajexal</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4373">grpc-ecosystem/grpc-gateway#4373</a></li>
<li>adding gRPC gateway generator script by <a href="https://github.com/akoserwal"><code>@​akoserwal</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4426">grpc-ecosystem/grpc-gateway#4426</a></li>
<li>fix url gen-grpc-gateway-api by <a href="https://github.com/akoserwal"><code>@​akoserwal</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4434">grpc-ecosystem/grpc-gateway#4434</a></li>
<li>ci: upgrade to goreleaser v2 by <a href="https://github.com/johanbrandhorst"><code>@​johanbrandhorst</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4437">grpc-ecosystem/grpc-gateway#4437</a></li>
<li>docs: add grpc-starter transcoding to related projects by <a href="https://github.com/DanielLiu1123"><code>@​DanielLiu1123</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4456">grpc-ecosystem/grpc-gateway#4456</a></li>
<li>Fix build on 32bit systems by <a href="https://github.com/gibmat"><code>@​gibmat</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4557">grpc-ecosystem/grpc-gateway#4557</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/nikitaksv"><code>@​nikitaksv</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4290">grpc-ecosystem/grpc-gateway#4290</a></li>
<li><a href="https://github.com/vajexal"><code>@​vajexal</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4373">grpc-ecosystem/grpc-gateway#4373</a></li>
<li><a href="https://github.com/akoserwal"><code>@​akoserwal</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4426">grpc-ecosystem/grpc-gateway#4426</a></li>
<li><a href="https://github.com/DanielLiu1123"><code>@​DanielLiu1123</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4456">grpc-ecosystem/grpc-gateway#4456</a></li>
<li><a href="https://github.com/gibmat"><code>@​gibmat</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4557">grpc-ecosystem/grpc-gateway#4557</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.20.0...v2.21.0">https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.20.0...v2.21.0</a></p>
<h2>v2.20.0</h2>
<h2>What's Changed</h2>
<ul>
<li>api_visibility option now transitively hides request/response messages by <a href="https://github.com/Place1"><code>@​Place1</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/3966">grpc-ecosystem/grpc-gateway#3966</a></li>
<li>Marshal non proto fields with indents by <a href="https://github.com/gknw"><code>@​gknw</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4027">grpc-ecosystem/grpc-gateway#4027</a></li>
<li>chore: fix some comments by <a href="https://github.com/avoidalone"><code>@​avoidalone</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4092">grpc-ecosystem/grpc-gateway#4092</a></li>
<li>chore(examples): add one example to log request body when the status code is non 200 by <a href="https://github.com/richzw"><code>@​richzw</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4108">grpc-ecosystem/grpc-gateway#4108</a></li>
<li>feat(bazel): surface --disable_default_responses in rule def by <a href="https://github.com/rajukrishnamurthy"><code>@​rajukrishnamurthy</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4126">grpc-ecosystem/grpc-gateway#4126</a></li>
<li>integration: fix wrapping of response writer causing endless test loop by <a href="https://github.com/johanbrandhorst"><code>@​johanbrandhorst</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4131">grpc-ecosystem/grpc-gateway#4131</a></li>
<li>Omit enum field when value is empty by <a href="https://github.com/jeromefroe"><code>@​jeromefroe</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4180">grpc-ecosystem/grpc-gateway#4180</a></li>
<li>docs/mapping/examples.md: update CoreOS example GitHub branch to <code>master</code> branch by <a href="https://github.com/mohamedawnallah"><code>@​mohamedawnallah</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4198">grpc-ecosystem/grpc-gateway#4198</a></li>
<li>chore: remove repetitive word by <a href="https://github.com/mountcount"><code>@​mountcount</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4183">grpc-ecosystem/grpc-gateway#4183</a></li>
<li>Fix Typo in examples.md by <a href="https://github.com/umakantv"><code>@​umakantv</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4212">grpc-ecosystem/grpc-gateway#4212</a></li>
<li>Write Content-Length header if doForwardTrailers is not set by <a href="https://github.com/joshgarnett"><code>@​joshgarnett</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4259">grpc-ecosystem/grpc-gateway#4259</a></li>
<li>Fixing TestOutgoingTrailerMatcher, which was non-deterministic by <a href="https://github.com/joshgarnett"><code>@​joshgarnett</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4265">grpc-ecosystem/grpc-gateway#4265</a></li>
<li>Update README.md by <a href="https://github.com/MakDon"><code>@​MakDon</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4322">grpc-ecosystem/grpc-gateway#4322</a></li>
<li>fix(4245): setting appropriate log level for error logs by <a href="https://github.com/rajeshkarnena"><code>@​rajeshkarnena</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4327">grpc-ecosystem/grpc-gateway#4327</a></li>
<li>fix: handle <code>X-Forwarded-*</code> headers correctly by <a href="https://github.com/haines"><code>@​haines</code></a> in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4334">grpc-ecosystem/grpc-gateway#4334</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Place1"><code>@​Place1</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/3966">grpc-ecosystem/grpc-gateway#3966</a></li>
<li><a href="https://github.com/avoidalone"><code>@​avoidalone</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4092">grpc-ecosystem/grpc-gateway#4092</a></li>
<li><a href="https://github.com/richzw"><code>@​richzw</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4108">grpc-ecosystem/grpc-gateway#4108</a></li>
<li><a href="https://github.com/rajukrishnamurthy"><code>@​rajukrishnamurthy</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4126">grpc-ecosystem/grpc-gateway#4126</a></li>
<li><a href="https://github.com/jeromefroe"><code>@​jeromefroe</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4180">grpc-ecosystem/grpc-gateway#4180</a></li>
<li><a href="https://github.com/mohamedawnallah"><code>@​mohamedawnallah</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4198">grpc-ecosystem/grpc-gateway#4198</a></li>
<li><a href="https://github.com/mountcount"><code>@​mountcount</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4183">grpc-ecosystem/grpc-gateway#4183</a></li>
<li><a href="https://github.com/umakantv"><code>@​umakantv</code></a> made their first contribution in <a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/pull/4212">grpc-ecosystem/grpc-gateway#4212</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/f41fd20b7e88ba6993338a0cb2c787f7076113e3"><code>f41fd20</code></a> Fix build on 32bit systems (<a href="https://redirect.github.com/grpc-ecosystem/grpc-gateway/issues/4557">#4557</a>)</li>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/db9cebd2858e8601283de3149b26526125b4c038"><code>db9cebd</code></a> chore(deps): update googleapis digest to 3f4e29a</li>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/22c97cd1051a09b3c8a0a99b8d841eccf4aac082"><code>22c97cd</code></a> chore(deps): update googleapis digest to 68d8154</li>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/39b04b77e7d620bb65b5d087e072cf9d4fca982e"><code>39b04b7</code></a> chore(deps): update googleapis digest to a91d1a3</li>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/0c2a9289e4ea9eb03783849e3fcbaed34aabdadb"><code>0c2a928</code></a> chore(deps): update googleapis digest to 6cabb8b</li>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/6811367fdd3e27081819204d21d50999d41230e3"><code>6811367</code></a> chore(deps): update googleapis digest to ec69fcc</li>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/8508633ca6fc9448d1db4f6ed49a6b0a3e23601a"><code>8508633</code></a> fix(deps): update google.golang.org/genproto/googleapis/rpc digest to e6d459c</li>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/92fd444062c53ca519ba9a6454bf8b78d1833af1"><code>92fd444</code></a> chore(deps): update googleapis digest to 6f08435</li>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/6266c42a69104661a67380059c84b2918e7f566f"><code>6266c42</code></a> fix(deps): update google.golang.org/genproto/googleapis/api digest to e6d459c</li>
<li><a href="https://github.com/grpc-ecosystem/grpc-gateway/commit/150780724f765d5bf29d2e1e08b9878f98ed2258"><code>1507807</code></a> chore(deps): update googleapis digest to 51d7fa8</li>
<li>Additional commits viewable in <a href="https://github.com/grpc-ecosystem/grpc-gateway/compare/v2.19.1...v2.21.0">compare view</a></li>
</ul>
</details>
<br />

Updates `google.golang.org/grpc/cmd/protoc-gen-go-grpc` from 1.3.0 to 1.5.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc/cmd/protoc-gen-go-grpc's releases</a>.</em></p>
<blockquote>
<h2>protoc-gen-go-grpc v1.5.1</h2>
<h1>Dependencies</h1>
<ul>
<li>Removed <code>replace</code> directive (needed only for testing), since it is incompatible with <code>go install</code> (<a href="https://redirect.github.com/grpc/grpc-go/issues/7451">#7451</a>).</li>
</ul>
<h2>protoc-gen-go-grpc v1.5.0</h2>
<h1>Security</h1>
<ul>
<li>The generated function <code>Register&lt;Service&gt;Server</code> now <strong>panics</strong> if the <code>Unimplemented&lt;Service&gt;Server</code> struct is embedded in a way that would otherwise lead to runtime panics if an unimplemented method was called.  Users are advised to ensure they are properly embedding the <code>Unimplemented</code> struct for their service, and to regenerate their proto files to confirm. (<a href="https://redirect.github.com/grpc/grpc-go/issues/7438">#7438</a>)
<ul>
<li>Note: &quot;Proper embedding&quot; of the <code>Unimplemented</code> struct means either embedding the struct by value (preferred) or ensuring it is always initialized to a valid pointer.  E.g.</li>
</ul>
</li>
</ul>
<pre lang="go"><code>struct MyServiceImpl {
	pb.UnimplementedMyServiceServer // embedded by value, not pointer
	// .. other struct fields ..
}
</code></pre>
<h1>New Features</h1>
<ul>
<li>Generated code for services will produce streaming method definitions using one of six different generic types (e.g. <code>BidiStreamingServer</code> or <code>ClientStreamingClient</code>) instead of producing complete interfaces and implementations for the streaming methods.  This can be disabled by setting <code>use_generic_streams_experimental=false</code>.  Please file a bug if you encounter any issues with this behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/7387">#7387</a>)</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>A period (.) is added to the end of the service interface doc comment to comply with Godoc. (<a href="https://redirect.github.com/grpc/grpc-go/issues/7392">#7392</a>)</li>
</ul>
<h2>protoc-gen-go-grpc v1.4.0</h2>
<h1>New Features</h1>
<ul>
<li>Add an optional implementation of streams using generics (Experimental) (<a href="https://redirect.github.com/grpc/grpc-go/issues/7057">#7057</a>)
<ul>
<li>The new <code>use_generic_stream_experimental=true</code> <a href="https://github.com/grpc/grpc-go/blob/1958fcbe2ca8bd93af633f11e97d44e567e945af/cmd/protoc-gen-go-grpc/main.go#L59">option</a> will cause the gRPC codegen to use prebuilt generic types to implement client and server stream objects, rather than generating new types and implementations for every RPC method. We intend to transition this to the default behavior in the next release.  Please test it and provide any feedback.</li>
<li>Special Thanks: <a href="https://github.com/aarongable"><code>@​aarongable</code></a></li>
</ul>
</li>
<li>Copy service comments to interfaces in generated code (<a href="https://redirect.github.com/grpc/grpc-go/issues/7243">#7243</a>)
<ul>
<li>Special Thanks: <a href="https://github.com/silves-xiang"><code>@​silves-xiang</code></a></li>
</ul>
</li>
<li>Generated code includes static method gRPC call options for integration with the upcoming OpenTelemetry metrics support (<a href="https://redirect.github.com/grpc/grpc-go/issues/6960">#6960</a>)</li>
</ul>
<h1>Dependencies</h1>
<ul>
<li>Update <code>google.golang.org/protobuf</code> dependency to <a href="https://pkg.go.dev/google.golang.org/protobuf@v1.34.1">v1.34.1</a> to address <a href="https://github.com/advisories/GHSA-8r3f-844c-mc37">CVE-2024-24786</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/7274">#7274</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/grpc/grpc-go/commit/b8669c35455183da6d5c474ea6e72fbf55183274"><code>b8669c3</code></a> Change version to 1.5.1</li>
<li><a href="https://github.com/grpc/grpc-go/commit/5ad7775ee52e4ec85a5135b40ea21b778d3a7c0e"><code>5ad7775</code></a> Do not create new addrConn when connection error happens (<a href="https://redirect.github.com/grpc/grpc-go/issues/1369">#1369</a>)</li>
<li><a href="https://github.com/grpc/grpc-go/commit/284c78bcedbaf3aec025e8dc492deaf85d358bd7"><code>284c78b</code></a> Change version to 1.5.1-dev</li>
<li><a href="https://github.com/grpc/grpc-go/commit/172ccacff3cfbddedcf1ba5ea06cda943bc976c1"><code>172ccac</code></a> Change version to 1.5.0</li>
<li><a href="https://github.com/grpc/grpc-go/commit/939edc09d6577e6c1221b4a65feb1e3d88ba6439"><code>939edc0</code></a> Revert &quot;Use bufconn in end2end tests.&quot; (<a href="https://redirect.github.com/grpc/grpc-go/issues/1381">#1381</a>)</li>
<li><a href="https://github.com/grpc/grpc-go/commit/71260d21715bff9c2ac999d546349d4f4b77ef1d"><code>71260d2</code></a> Fix logging method (<a href="https://redirect.github.com/grpc/grpc-go/issues/1375">#1375</a>)</li>
<li><a href="https://github.com/grpc/grpc-go/commit/c7e2c00ed1df1690ec11b9984b3fa8da1bfafbdd"><code>c7e2c00</code></a> Use bufconn in end2end tests.</li>
<li><a href="https://github.com/grpc/grpc-go/commit/9a71c7940b476fa96578035020a8ab48e04e7f0b"><code>9a71c79</code></a> Create bufconn package for a local, buffered net.Conn and dialer/listener</li>
<li><a href="https://github.com/grpc/grpc-go/commit/ce03e9cc712c2009613184c73f2c140cc42beffe"><code>ce03e9c</code></a> Fix a typo in examples/gotutorial.md (<a href="https://redirect.github.com/grpc/grpc-go/issues/1374">#1374</a>)</li>
<li><a href="https://github.com/grpc/grpc-go/commit/d6723916d2e73e8824d22a1ba5c52f8e6255e6f8"><code>d672391</code></a> Use log severity and verbosity level (<a href="https://redirect.github.com/grpc/grpc-go/issues/1340">#1340</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.3.0...v1.5.1">compare view</a></li>
</ul>
</details>
<br />

Updates `google.golang.org/protobuf` from 1.33.0 to 1.34.2


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions


</details>


Patch:
diff --git a/.github/workflows/protoc-dependabot-hack.yml b/.github/workflows/protoc-dependabot-hack.yml
index af09284..7fcc9ed 100644
--- a/.github/workflows/protoc-dependabot-hack.yml
+++ b/.github/workflows/protoc-dependabot-hack.yml
@@ -16,4 +16,4 @@ jobs:
 
       # update the version in these places manually when Dependabot proposes a change to it here:
       # 1. the version in main.yml used to install protoc
-      - uses: protocolbuffers/protobuf@v27.2
+      - uses: protocolbuffers/protobuf@v27.3
diff --git a/.github/workflows/scorecard_action.yml b/.github/workflows/scorecard_action.yml
index 791ac9b..3b5d9e0 100644
--- a/.github/workflows/scorecard_action.yml
+++ b/.github/workflows/scorecard_action.yml
@@ -44,7 +44,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+        uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
         with:
           name: SARIF file
           path: results.sarif
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 14f6b0a..11d71f2 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -68,7 +68,7 @@ jobs:
           check-latest: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@a4f60bb28d35aeee14e6880718e0c85ff1882e64 # v6.0.1
+        uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
         timeout-minutes: 10
         with:
           version: v1.59
diff --git a/config/identity/config.yaml b/config/identity/config.yaml
index d9fb56f..1c7685c 100644
--- a/config/identity/config.yaml
+++ b/config/identity/config.yaml
@@ -15,6 +15,8 @@
 define:
   - &github-type "github-workflow"
   - &gitlab-type "gitlab-pipeline"
+  - &codefresh-type "codefresh-workflow"
+  - &buildkite-type "buildkite-job"
 oidc-issuers:
   https://accounts.google.com:
     issuer-url: https://accounts.google.com
@@ -25,7 +27,8 @@ oidc-issuers:
   https://agent.buildkite.com:
     issuer-url: https://agent.buildkite.com
     client-id: sigstore
-    type: buildkite-job
+    type: ci-provider
+    ci-provider: *buildkite-type
     contact: support@buildkite.com
     description: "Buildkite Agent OIDC tokens for job identity"
   https://allow.pub:
@@ -84,7 +87,8 @@ oidc-issuers:
   https://oidc.codefresh.io:
     issuer-url: https://oidc.codefresh.io
     client-id: sigstore
-    type: codefresh-workflow
+    type: ci-provider
+    ci-provider: *codefresh-type
     contact: support@codefresh.io
     description: "Codefresh OIDC tokens for job identity"
   https://ops.gitlab.net:
@@ -120,45 +124,114 @@ meta-issuers:
     ci-provider: *github-type
 ci-issuer-metadata:
   *github-type:
-      default-template-values:
-          url: "https://github.com"
-      extension-templates:
-          github-workflow-trigger: "event_name"
-          github-workflow-sha: "sha"
-          github-workflow-name: "workflow"
-          github-workflow-repository: "repository"
-          github-workflow-ref: "ref"
-          build-signer-uri: "{{ .url }}/{{ .job_workflow_ref }}"
-          build-signer-digest: "job_workflow_sha"
-          runner-environment: "runner_environment"
-          source-repository-uri: "{{ .url }}/{{ .repository }}"
-          source-repository-digest: "sha"
-          source-repository-ref: "ref"
-          source-repository-identifier: "repository_id"
-          source-repository-owner-uri: "{{ .url }}/{{ .repository_owner }}"
-          source-repository-owner-identifier: "repository_owner_id"
-          build-config-uri: "{{ .url }}/{{ .workflow_ref }}"
-          build-config-digest: "workflow_sha"
-          build-trigger: "event_name"
-          run-invocation-uri: "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}"
-          source-repository-visibility-at-signing: "repository_visibility"
-      subject-alternative-name-template: "{{ .url }}/{{ .job_workflow_ref }}"
+    default-template-values:
+      # url: URL of issuer, https://github.com
+      url: "https://github.com"
+    extension-templates:
+      # event_name: Event that triggered this workflow run. E.g "push", "tag"
+      github-workflow-trigger: "event_name"
+      # sha: Commit SHA being built
+      github-workflow-sha: "sha"
+      # workflow (Deprecated): Name of workflow that is running (mutable)
+      github-workflow-name: "workflow"
+      # repository: Name of repository being built
+      github-workflow-repository: "repository"
+      # ref: Git ref being built
+      github-workflow-ref: "ref"
+      # job_workflow_ref: Specific build instructions (i.e. reusable workflow)
+      build-signer-uri: "{{ .url }}/{{ .job_workflow_ref }}"
+      # job_workflow_sha: Commit SHA to specific build instructions
+      build-signer-digest: "job_workflow_sha"
+      # runner_environment: Whether the build took place in cloud or self-hosted infrastructure
+      runner-environment: "runner_environment"
+      # repository: Name of repository being built
+      source-repository-uri: "{{ .url }}/{{ .repository }}"
+      source-repository-digest: "sha"
+      source-repository-ref: "ref"
+      # repository_id: ID to the source repo
+      source-repository-identifier: "repository_id"
+      # repository_owner: Owner of the source repo (mutable)
+      source-repository-owner-uri: "{{ .url }}/{{ .repository_owner }}"
+      # repository_owner_id: ID of the source repo
+      source-repository-owner-identifier: "repository_owner_id"
+      # workflow_ref: Ref of top-level workflow that is running
+      build-config-uri: "{{ .url }}/{{ .workflow_ref }}"
+      # workflow_sha: Commit SHA of top-level workflow that is running
+      build-config-digest: "workflow_sha"
+      build-trigger: "event_name"
+      # run_id: ID of workflow run
+      # run_attempt: Attempt number of workflow run
+      run-invocation-uri: "{{ .url }}/{{ .repository }}/actions/runs/{{ .run_id }}/attempts/{{ .run_attempt }}"
+      # repository_visibility: Visibility of the source repo
+      source-repository-visibility-at-signing: "repository_visibility"
+    subject-alternative-name-template: "{{ .url }}/{{ .job_workflow_ref }}"
   *gitlab-type:
     default-template-values:
-        url: "https://gitlab.com"
+      url: "https://gitlab.com"
     extension-templates:
-        build-signer-uri: "https://{{ .ci_config_ref_uri }}"
-        build-signer-digest: "ci_config_sha"
-        runner-environment: "runner_environment"
-        source-repository-uri: "{{ .url }}/{{ .repository }}"
-        source-repository-digest: "sha"
-        source-repository-ref: refs/{{if eq .ref_type "branch"}}heads/{{ else }}tags/{{end}}/{{ .ref }}
-        source-repository-identifier: "project_id"
-        source-repository-owner-uri: "{{ .url }}/{{ .namespace_path }}"
-        source-repository-owner-identifier: "namespace_id"
-        build-config-uri: "https://{{ .ci_config_ref_uri }}"
-        build-config-digest: "ci_config_sha"
-        build-trigger: "pipeline_source"
-        run-invocation-uri: "{{ .url }}/{{ .project_path }}/-/jobs/{{ .job_id }}"
-        source-repository-visibility-at-signing: "repository_visibility"
+      # url: The URL of the GitLab instance. https://gitlab.com
+      # ci_config_ref_uri: Ref of top-level pipeline definition.
+      # E.g. gitlab.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main
+      build-signer-uri: "https://{{ .ci_config_ref_uri }}"
+      # ci_config_sha: Commit sha of top-level pipeline definition, and is
+      # only populated when `ciConfigRefURI` is local to the GitLab instance
+      build-signer-digest: "ci_config_sha"
+      # runner_environment: The type of runner used by the job. May be one of gitlab-hosted or self-hosted.
+      runner-environment: "runner_environment"
+      # repository: Repository building built
+      source-repository-uri: "{{ .url }}/{{ .repository }}"
+      # sha: Commit SHA being built
+      source-repository-digest: "sha"
+      # ref_type: The type of the ref
+      # E.g. "branch", "tag"
+      # ref: Git ref being built
+      source-repository-ref: refs/{{if eq .ref_type "branch"}}heads/{{ else }}tags/{{end}}/{{ .ref }}
+      # project_id: ID to the source repo
+      source-repository-identifier: "project_id"
+      # namespace_path: Owner of the source repo (mutable)
+      source-repository-owner-uri: "{{ .url }}/{{ .namespace_path }}"
+      # namespace_id: ID of the source repo
+      source-repository-owner-identifier: "namespace_id"
+      build-config-uri: "https://{{ .ci_config_ref_uri }}"
+      build-config-digest: "ci_config_sha"
+      # pipeline_source: Event that triggered this workflow run. E.g "push", "tag" etc
+      build-trigger: "pipeline_source"
+      # project_path: Repository building built
+      # job_id: job ID
+      run-invocation-uri: "{{ .url }}/{{ .project_path }}/-/jobs/{{ .job_id }}"
+      # project_visibility: Visibility of the source project
+      source-repository-visibility-at-signing: "project_visibility"
     subject-alternative-name-template: "https://{{ .ci_config_ref_uri }}"
+  *codefresh-type:
+    default-template-values:
+      # We are setting the default value for "platform_url" as the ci-provider
+      # principal gives priority to the claimed value over the default
+      # when they have the same name. Then it will use the default "platform_url" value
+      # for cases that the claimed data doesn't exist.
+      # platform_url: Codefresh platform url
+      platform_url: "https://g.codefresh.io"
+    extension-templates:
+      # workflow_id: The ID of the specific workflow authorized in the claim.
+      # For example, 64f447c02199f903000gh20.
+      build-signer-uri: "{{.platform_url}}/build/{{ .workflow_id }}"
+      # runner_environment: Whether the build took place in cloud or self-hosted infrastructure
+      runner-environment: "runner_environment"
+      # scm_repo_url: Applies to Git push, PR, and manual Git trigger types.
+      # The SCM URL specifying the Git repository’s location.
+      # For example, https://github.com/codefresh-user/oidc-test
+      source-repository-uri: "scm_repo_url"
+      # scm_ref: Applies to Git push, PR, and manual Git trigger types.
+      # The SCM name of the branch or tag within the Git repository
+      # for which the workflow should execute. For example, main or v1.0.0.
+      source-repository-ref: "scm_ref"
+      # pipeline_id: Codefresh Pipeline id
+      build-config-uri: "{{.platform_url}}/api/pipelines/{{ .pipeline_id }}"
+      # account_name: Codefresh account name
+      # pipeline_name: Codefresh pipline name (project/pipeline)
+      # account_id: Codefresh account id
+      run-invocation-uri: "{{.platform_url}}/build/{{ .workflow_id }}"
+    subject-alternative-name-template: "{{.platform_url}}/{{.account_name}}/{{.pipeline_name}}:{{.account_id}}/{{.pipeline_id}}"
+  *buildkite-type:
+    default-template-values:
+      url: "https://buildkite.com"
+    subject-alternative-name-template: "{{.url}}/{{.organization_slug}}/{{.pipeline_slug}}"
diff --git a/docs/oidc.md b/docs/oidc.md
index 653644e..61b354e 100644
--- a/docs/oidc.md
+++ b/docs/oidc.md
@@ -12,7 +12,7 @@ To add a new OIDC issuer:
 
 * Add the new issuer to the [configuration](https://github.com/sigstore/fulcio/blob/main/config/identity/config.yaml).
   * Attention: If your issuer is for a CI provider, you should set the `type` as `ci-provider` and set the field `ci-provider` with the name of your provider. You should also fill the `ci-issuer-metadata` with the `default-template-values`, `extension-templates` and `subject-alternative-name-template`, following the pattern defined on the example ([example](tbd after migrating the github to ci-provider)).
-  * Important notes: The `extension-templates` and the `subject-alternative-name-template` follows the templates [pattern](https://pkg.go.dev/text/template). The name used to fill the `ci-provider` field has to be the same used as key for `ci-issuer-metadata`, we suggest to use a variable for this.
+  * Important notes: The `extension-templates` and the `subject-alternative-name-template` follows the templates [pattern](https://pkg.go.dev/text/template). The name used to fill the `ci-provider` field has to be the same used as key for `ci-issuer-metadata`, we suggest to use a variable for this. If you set a `default-template-value` with the same name of a claim key, the claimed value will have priority over the default one.
 * If your issuer is not for a CI provider, you need to follow the next steps:
   * Add the new issuer to the [`identity` folder](https://github.com/sigstore/fulcio/tree/main/pkg/identity) ([example](https://github.com/sigstore/fulcio/tree/main/pkg/identity/email)). You will define an `Issuer` type and a way to map the token to the certificate extensions.
   * Define a constant with the issuer type name in the [configuration](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config.go#L213-L221), add update the [tests](https://github.com/sigstore/fulcio/blob/afeadb3b7d11f704489637cabc4e150dea3e00ed/pkg/config/config_test.go#L473-L503)
diff --git a/go.mod b/go.mod
index 09f94f3..a59b034 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.22.5
 
 require (
 	chainguard.dev/go-grpc-kit v0.17.5
-	chainguard.dev/sdk v0.1.21
+	chainguard.dev/sdk v0.1.22
 	cloud.google.com/go/security v1.17.4
 	github.com/PaesslerAG/jsonpath v0.1.1
 	github.com/ThalesIgnite/crypto11 v1.2.5
@@ -35,10 +35,10 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.19.0
 	github.com/spiffe/go-spiffe/v2 v2.3.0
-	go.step.sm/crypto v0.50.0
+	go.step.sm/crypto v0.51.1
 	go.uber.org/zap v1.27.0
-	google.golang.org/api v0.189.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20240723171418-e6d459c13d2a
+	google.golang.org/api v0.190.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f
 	google.golang.org/grpc v1.65.0
 	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v3 v3.0.1
@@ -47,34 +47,34 @@ require (
 
 require (
 	cloud.google.com/go v0.115.0 // indirect
-	cloud.google.com/go/auth v0.7.2 // indirect
+	cloud.google.com/go/auth v0.7.3 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.3 // indirect
 	cloud.google.com/go/compute/metadata v0.5.0 // indirect
-	cloud.google.com/go/iam v1.1.10 // indirect
-	cloud.google.com/go/kms v1.18.2 // indirect
-	cloud.google.com/go/longrunning v0.5.9 // indirect
+	cloud.google.com/go/iam v1.1.12 // indirect
+	cloud.google.com/go/kms v1.18.4 // indirect
+	cloud.google.com/go/longrunning v0.5.11 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.13.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.9.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
 	github.com/PaesslerAG/gval v1.0.0 // indirect
 	github.com/aws/aws-sdk-go v1.54.16 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.30.1 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.27.24 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.24 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.9 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.13 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.13 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.30.3 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.27.27 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.27 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/kms v1.35.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.22.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.30.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kms v1.35.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 // indirect
 	github.com/aws/smithy-go v1.20.3 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
@@ -89,7 +89,7 @@ require (
 	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/go-containerregistry v0.20.0 // indirect
-	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/google/s2a-go v0.1.8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
 	github.com/googleapis/gax-go/v2 v2.13.0 // indirect
@@ -150,8 +150,8 @@ require (
 	golang.org/x/term v0.22.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	google.golang.org/genproto v0.0.0-20240722135656-d784300faade // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240723171418-e6d459c13d2a // indirect
+	google.golang.org/genproto v0.0.0-20240730163845-b1a4ccb954bf // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 2642ea8..a6ce3f2 100644
--- a/go.sum
+++ b/go.sum
@@ -1,32 +1,32 @@
 chainguard.dev/go-grpc-kit v0.17.5 h1:y0MHgqm3v0LKKQfxPJV57wkXxa8uMSpNTjhtHbNh1DY=
 chainguard.dev/go-grpc-kit v0.17.5/go.mod h1:vQGcwZiX6jXwhyLPCZwVMvjITD+XcrSmQzuCTW/XcVc=
-chainguard.dev/sdk v0.1.21 h1:D10Gvq69Sep23WkM9NA9qjch19ZzWY9KV4wJKt5FK5Y=
-chainguard.dev/sdk v0.1.21/go.mod h1:d/kBHuWjnNcLZUDSz1xwhnc/pDeWqweGvs6+fogAAZI=
+chainguard.dev/sdk v0.1.22 h1:qXYJiaGTd9QqS8FP6qS4GXrO21sA27PY7cizcFzR14Q=
+chainguard.dev/sdk v0.1.22/go.mod h1:N2m/Jg2mj2Qi9EupzTuwUQQQbp76WbbwSbxaB8V4YDo=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
 cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
-cloud.google.com/go/auth v0.7.2 h1:uiha352VrCDMXg+yoBtaD0tUF4Kv9vrtrWPYXwutnDE=
-cloud.google.com/go/auth v0.7.2/go.mod h1:VEc4p5NNxycWQTMQEDQF0bd6aTMb6VgYDXEwiJJQAbs=
+cloud.google.com/go/auth v0.7.3 h1:98Vr+5jMaCZ5NZk6e/uBgf60phTk/XN84r8QEWB9yjY=
+cloud.google.com/go/auth v0.7.3/go.mod h1:HJtWUx1P5eqjy/f6Iq5KeytNpbAcGolPhOgyop2LlzA=
 cloud.google.com/go/auth/oauth2adapt v0.2.3 h1:MlxF+Pd3OmSudg/b1yZ5lJwoXCEaeedAguodky1PcKI=
 cloud.google.com/go/auth/oauth2adapt v0.2.3/go.mod h1:tMQXOfZzFuNuUxOypHlQEXgdfX5cuhwU+ffUuXRJE8I=
 cloud.google.com/go/compute/metadata v0.5.0 h1:Zr0eK8JbFv6+Wi4ilXAR8FJ3wyNdpxHKJNPos6LTZOY=
 cloud.google.com/go/compute/metadata v0.5.0/go.mod h1:aHnloV2TPI38yx4s9+wAZhHykWvVCfu7hQbF+9CWoiY=
-cloud.google.com/go/iam v1.1.10 h1:ZSAr64oEhQSClwBL670MsJAW5/RLiC6kfw3Bqmd5ZDI=
-cloud.google.com/go/iam v1.1.10/go.mod h1:iEgMq62sg8zx446GCaijmA2Miwg5o3UbO+nI47WHJps=
-cloud.google.com/go/kms v1.18.2 h1:EGgD0B9k9tOOkbPhYW1PHo2W0teamAUYMOUIcDRMfPk=
-cloud.google.com/go/kms v1.18.2/go.mod h1:YFz1LYrnGsXARuRePL729oINmN5J/5e7nYijgvfiIeY=
-cloud.google.com/go/longrunning v0.5.9 h1:haH9pAuXdPAMqHvzX0zlWQigXT7B0+CL4/2nXXdBo5k=
-cloud.google.com/go/longrunning v0.5.9/go.mod h1:HD+0l9/OOW0za6UWdKJtXoFAX/BGg/3Wj8p10NeWF7c=
+cloud.google.com/go/iam v1.1.12 h1:JixGLimRrNGcxvJEQ8+clfLxPlbeZA6MuRJ+qJNQ5Xw=
+cloud.google.com/go/iam v1.1.12/go.mod h1:9LDX8J7dN5YRyzVHxwQzrQs9opFFqn0Mxs9nAeB+Hhg=
+cloud.google.com/go/kms v1.18.4 h1:dYN3OCsQ6wJLLtOnI8DGUwQ5shMusXsWCCC+s09ATsk=
+cloud.google.com/go/kms v1.18.4/go.mod h1:SG1bgQ3UWW6/KdPo9uuJnzELXY5YTTMJtDYvajiQ22g=
+cloud.google.com/go/longrunning v0.5.11 h1:Havn1kGjz3whCfoD8dxMLP73Ph5w+ODyZB9RUsDxtGk=
+cloud.google.com/go/longrunning v0.5.11/go.mod h1:rDn7//lmlfWV1Dx6IB4RatCPenTwwmqXuiP0/RgoEO4=
 cloud.google.com/go/security v1.17.4 h1:ERhxAa02mnMEIIAXvzje+qJ+yWniP6l5uOX+k9ELCaA=
 cloud.google.com/go/security v1.17.4/go.mod h1:KMuDJH+sEB3KTODd/tLJ7kZK+u2PQt+Cfu0oAxzIhgo=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0 h1:1nGuui+4POelzDwI7RG56yfQJHCnKvwfMoU7VsEp+Zg=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0/go.mod h1:99EvauvlcJ1U06amZiksfYz/3aFGyIhWGHVyiZXtBAI=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.13.0 h1:GJHeeA2N7xrG3q30L2UXDyuWRzDM900/65j70wcM4Ww=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.13.0/go.mod h1:l38EPgmsp71HHLq9j7De57JcKOWPyhrsW1Awm1JS6K0=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 h1:tfLQ34V6F7tVSwoTf/4lH5sE0o6eCJuNDTmH09nDpbc=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.9.0 h1:H+U3Gk9zY56G3u872L82bk4thcsy2Gghb9ExT4Zvm1o=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.9.0/go.mod h1:mgrmMSgaLp9hmax62XQTd0N4aAqSE5E0DulSpVYK7vc=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0 h1:DRiANoJTiW6obBQe3SqZizkuV1PEgfiiGivmVocDy64=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0/go.mod h1:qLIye2hwb/ZouqhpSD9Zn3SJipvpEnz1Ywl3VUk9Y0s=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0 h1:D3occbWoio4EBLkbkevetNMAVX197GkzbUMtqjGWn80=
@@ -46,32 +46,32 @@ github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.54.16 h1:+B9zGaVwOUU6AO9Sy99VjTMDPthWx10HjB08hjaBHIc=
 github.com/aws/aws-sdk-go v1.54.16/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.30.1 h1:4y/5Dvfrhd1MxRDD77SrfsDaj8kUkkljU7XE83NPV+o=
-github.com/aws/aws-sdk-go-v2 v1.30.1/go.mod h1:nIQjQVp5sfpQcTc9mPSr1B0PaWK5ByX9MOoDadSN4lc=
-github.com/aws/aws-sdk-go-v2/config v1.27.24 h1:NM9XicZ5o1CBU/MZaHwFtimRpWx9ohAUAqkG6AqSqPo=
-github.com/aws/aws-sdk-go-v2/config v1.27.24/go.mod h1:aXzi6QJTuQRVVusAO8/NxpdTeTyr/wRcybdDtfUwJSs=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.24 h1:YclAsrnb1/GTQNt2nzv+756Iw4mF8AOzcDfweWwwm/M=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.24/go.mod h1:Hld7tmnAkoBQdTMNYZGzztzKRdA4fCdn9L83LOoigac=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.9 h1:Aznqksmd6Rfv2HQN9cpqIV/lQRMaIpJkLLaJ1ZI76no=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.9/go.mod h1:WQr3MY7AxGNxaqAtsDWn+fBxmd4XvLkzeqQ8P1VM0/w=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.13 h1:5SAoZ4jYpGH4721ZNoS1znQrhOfZinOhc4XuTXx/nVc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.13/go.mod h1:+rdA6ZLpaSeM7tSg/B0IEDinCIBJGmW8rKDFkYpP04g=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.13 h1:WIijqeaAO7TYFLbhsZmi2rgLEAtWOC1LhxCAVTJlSKw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.13/go.mod h1:i+kbfa76PQbWw/ULoWnp51EYVWH4ENln76fLQE3lXT8=
+github.com/aws/aws-sdk-go-v2 v1.30.3 h1:jUeBtG0Ih+ZIFH0F4UkmL9w3cSpaMv9tYYDbzILP8dY=
+github.com/aws/aws-sdk-go-v2 v1.30.3/go.mod h1:nIQjQVp5sfpQcTc9mPSr1B0PaWK5ByX9MOoDadSN4lc=
+github.com/aws/aws-sdk-go-v2/config v1.27.27 h1:HdqgGt1OAP0HkEDDShEl0oSYa9ZZBSOmKpdpsDMdO90=
+github.com/aws/aws-sdk-go-v2/config v1.27.27/go.mod h1:MVYamCg76dFNINkZFu4n4RjDixhVr51HLj4ErWzrVwg=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.27 h1:2raNba6gr2IfA0eqqiP2XiQ0UVOpGPgDSi0I9iAP+UI=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.27/go.mod h1:gniiwbGahQByxan6YjQUMcW4Aov6bLC3m+evgcoN4r4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 h1:KreluoV8FZDEtI6Co2xuNk/UqI9iwMrOx/87PBNIKqw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11/go.mod h1:SeSUYBLsMYFoRvHE0Tjvn7kbxaUhl75CJi1sbfhMxkU=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 h1:SoNJ4RlFEQEbtDcCEt+QG56MY4fm4W8rYirAmq+/DdU=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15/go.mod h1:U9ke74k1n2bf+RIgoX1SXFed1HLs51OgUSs+Ph0KJP8=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 h1:C6WHdGnTDIYETAm5iErQUiVNsclNx9qbJVPIt03B6bI=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15/go.mod h1:ZQLZqhcu+JhSrA9/NXRm8SkDvsycE+JkV3WGY41e+IM=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 h1:dT3MqvGhSoaIhRseqw2I0yH81l7wiR2vjs57O51EAm8=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3/go.mod h1:GlAeCkHwugxdHaueRr4nhPuY+WW+gR8UjlcqzPr1SPI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.15 h1:I9zMeF107l0rJrpnHpjEiiTSCKYAIw8mALiXcPsGBiA=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.15/go.mod h1:9xWJ3Q/S6Ojusz1UIkfycgD1mGirJfLLKqq3LPT7WN8=
-github.com/aws/aws-sdk-go-v2/service/kms v1.35.1 h1:0gP2OJJT6HM2BYltZ9x+A87OE8LJL96DXeAAdLv3t1M=
-github.com/aws/aws-sdk-go-v2/service/kms v1.35.1/go.mod h1:hGONorZkQCfR5DW6l2xdy7zC8vfO0r9pJlwyg6gmGeo=
-github.com/aws/aws-sdk-go-v2/service/sso v1.22.1 h1:p1GahKIjyMDZtiKoIn0/jAj/TkMzfzndDv5+zi2Mhgc=
-github.com/aws/aws-sdk-go-v2/service/sso v1.22.1/go.mod h1:/vWdhoIoYA5hYoPZ6fm7Sv4d8701PiG5VKe8/pPJL60=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.2 h1:ORnrOK0C4WmYV/uYt3koHEWBLYsRDwk2Np+eEoyV4Z0=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.2/go.mod h1:xyFHA4zGxgYkdD73VeezHt3vSKEG9EmFnGwoKlP00u4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.30.1 h1:+woJ607dllHJQtsnJLi52ycuqHMwlW+Wqm2Ppsfp4nQ=
-github.com/aws/aws-sdk-go-v2/service/sts v1.30.1/go.mod h1:jiNR3JqT15Dm+QWq2SRgh0x0bCNSRP2L25+CqPNpJlQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 h1:HGErhhrxZlQ044RiM+WdoZxp0p+EGM62y3L6pwA4olE=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17/go.mod h1:RkZEx4l0EHYDJpWppMJ3nD9wZJAa8/0lq9aVC+r2UII=
+github.com/aws/aws-sdk-go-v2/service/kms v1.35.3 h1:UPTdlTOwWUX49fVi7cymEN6hDqCwe3LNv1vi7TXUutk=
+github.com/aws/aws-sdk-go-v2/service/kms v1.35.3/go.mod h1:gjDP16zn+WWalyaUqwCCioQ8gU8lzttCCc9jYsiQI/8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 h1:BXx0ZIxvrJdSgSvKTZ+yRBeSqqgPM89VPlulEcl37tM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.22.4/go.mod h1:ooyCOXjvJEsUw7x+ZDHeISPMhtwI3ZCB7ggFMcFfWLU=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 h1:yiwVzJW2ZxZTurVbYWA7QOrAaCYQR72t0wrSBfoesUE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4/go.mod h1:0oxfLkpz3rQ/CHlx5hB7H69YUpFiI1tql6Q6Ne+1bCw=
+github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 h1:ZsDKRLXGWHk8WdtyYMoGNO7bTudrvuKpDKgMVRlepGE=
+github.com/aws/aws-sdk-go-v2/service/sts v1.30.3/go.mod h1:zwySh8fpFyXp9yOr/KVzxOl8SRqgf/IDw5aUt9UKFcQ=
 github.com/aws/smithy-go v1.20.3 h1:ryHwveWzPV5BIof6fyDvor6V3iUL7nTfiTKXHiW05nE=
 github.com/aws/smithy-go v1.20.3/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
@@ -164,8 +164,8 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-containerregistry v0.20.0 h1:wRqHpOeVh3DnenOrPy9xDOLdnLatiGuuNRVelR2gSbg=
 github.com/google/go-containerregistry v0.20.0/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
-github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
-github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
+github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
+github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
 github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
 github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -380,8 +380,8 @@ go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+
 go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
 go.opentelemetry.io/proto/otlp v1.2.0 h1:pVeZGk7nXDC9O2hncA6nHldxEjm6LByfA2aN8IOkz94=
 go.opentelemetry.io/proto/otlp v1.2.0/go.mod h1:gGpR8txAl5M03pDhMC79G6SdqNV26naRm/KDsgaHD8A=
-go.step.sm/crypto v0.50.0 h1:BqI9sEgocoHDLLHiZnFqdqXl5FjdMvOWKMm/fKL/lrw=
-go.step.sm/crypto v0.50.0/go.mod h1:NCFMhLS6FJXQ9sD9PP282oHtsBWLrI6wXZY0eOkq7t8=
+go.step.sm/crypto v0.51.1 h1:ktUg/2hetEMiBAqgz502ktZDGoDoGrcHFg3XpkmkvvA=
+go.step.sm/crypto v0.51.1/go.mod h1:PdrhttNU/tG9/YsVd4fdlysBN+UV503p0o2irFZQlAw=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -490,20 +490,20 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.189.0 h1:equMo30LypAkdkLMBqfeIqtyAnlyig1JSZArl4XPwdI=
-google.golang.org/api v0.189.0/go.mod h1:FLWGJKb0hb+pU2j+rJqwbnsF+ym+fQs73rbJ+KAUgy8=
+google.golang.org/api v0.190.0 h1:ASM+IhLY1zljNdLu19W1jTmU6A+gMk6M46Wlur61s+Q=
+google.golang.org/api v0.190.0/go.mod h1:QIr6I9iedBLnfqoD6L6Vze1UvS5Hzj5r2aUBOaZnLHo=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240722135656-d784300faade h1:lKFsS7wpngDgSCeFn7MoLy+wBDQZ1UQIJD4UNM1Qvkg=
-google.golang.org/genproto v0.0.0-20240722135656-d784300faade/go.mod h1:FfBgJBJg9GcpPvKIuHSZ/aE1g2ecGL74upMzGZjiGEY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240723171418-e6d459c13d2a h1:YIa/rzVqMEokBkPtydCkx1VLmv3An1Uw7w1P1m6EhOY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240723171418-e6d459c13d2a/go.mod h1:AHT0dDg3SoMOgZGnZk29b5xTbPHMoEC8qthmBLJCpys=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240723171418-e6d459c13d2a h1:hqK4+jJZXCU4pW7jsAdGOVFIfLHQeV7LaizZKnZ84HI=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240723171418-e6d459c13d2a/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/genproto v0.0.0-20240730163845-b1a4ccb954bf h1:OqdXDEakZCVtDiZTjcxfwbHPCT11ycCEsTKesBVKvyY=
+google.golang.org/genproto v0.0.0-20240730163845-b1a4ccb954bf/go.mod h1:mCr1K1c8kX+1iSBREvU3Juo11CB+QOEWxbRS01wWl5M=
+google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f h1:b1Ln/PG8orm0SsBbHZWke8dDp2lrCD4jSmfglFpTZbk=
+google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f/go.mod h1:AHT0dDg3SoMOgZGnZk29b5xTbPHMoEC8qthmBLJCpys=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf h1:liao9UHurZLtiEwBgT9LMOnKYsHze6eA6w1KQCMVN2Q=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index c6a5904..3fbdde5 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -3,33 +3,32 @@ module github.com/sigstore/fulcio/hack/tools
 go 1.22.5
 
 require (
-	github.com/googleapis/api-linter v1.65.0
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0
-	google.golang.org/protobuf v1.33.0
+	github.com/googleapis/api-linter v1.67.1
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.21.0
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
+	google.golang.org/protobuf v1.34.2
 )
 
 require (
 	bitbucket.org/creachadair/stringset v0.0.12 // indirect
-	cloud.google.com/go/longrunning v0.5.6 // indirect
+	cloud.google.com/go/longrunning v0.5.7 // indirect
 	github.com/bmatcuk/doublestar/v4 v4.6.1 // indirect
-	github.com/bufbuild/protocompile v0.8.0 // indirect
+	github.com/bufbuild/protocompile v0.10.0 // indirect
 	github.com/gertd/go-pluralize v0.2.1 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/jhump/protoreflect v1.15.6 // indirect
+	github.com/jhump/protoreflect v1.16.0 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/rogpeppe/go-internal v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/stoewer/go-strcase v1.3.0 // indirect
-	golang.org/x/net v0.23.0 // indirect
-	golang.org/x/sync v0.6.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
-	google.golang.org/grpc v1.62.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240723171418-e6d459c13d2a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240723171418-e6d459c13d2a // indirect
+	google.golang.org/grpc v1.65.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/hack/tools/go.sum b/hack/tools/go.sum
index 6a183c8..92e7416 100644
--- a/hack/tools/go.sum
+++ b/hack/tools/go.sum
@@ -1,11 +1,11 @@
 bitbucket.org/creachadair/stringset v0.0.12 h1:APD8dIoAzGv70a6p1oasPDjPwkp+ajszdgKyWUcNqo0=
 bitbucket.org/creachadair/stringset v0.0.12/go.mod h1:KtNk2s0hRO1T0r78lv9Zq/S/Lp0du2zI0Fj5j5Y4LDo=
-cloud.google.com/go/longrunning v0.5.6 h1:xAe8+0YaWoCKr9t1+aWe+OeQgN/iJK1fEgZSXmjuEaE=
-cloud.google.com/go/longrunning v0.5.6/go.mod h1:vUaDrWYOMKRuhiv6JBnn49YxCPz2Ayn9GqyjaBT8/mA=
+cloud.google.com/go/longrunning v0.5.7 h1:WLbHekDbjK1fVFD3ibpFFVoyizlLRl73I7YKuAKilhU=
+cloud.google.com/go/longrunning v0.5.7/go.mod h1:8GClkudohy1Fxm3owmBGid8W0pSgodEMwEAztp38Xng=
 github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwNy7PA4I=
 github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
-github.com/bufbuild/protocompile v0.8.0 h1:9Kp1q6OkS9L4nM3FYbr8vlJnEwtbpDPQlQOVXfR+78s=
-github.com/bufbuild/protocompile v0.8.0/go.mod h1:+Etjg4guZoAqzVk2czwEQP12yaxLJ8DxuqCJ9qHdH94=
+github.com/bufbuild/protocompile v0.10.0 h1:+jW/wnLMLxaCEG8AX9lD0bQ5v9h1RUiMKOBOT5ll9dM=
+github.com/bufbuild/protocompile v0.10.0/go.mod h1:G9qQIQo0xZ6Uyj6CMNz0saGmx2so+KONo8/KrELABiY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -16,12 +16,12 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/googleapis/api-linter v1.65.0 h1:bMEVAt5HGDsIIe+Fw77egLtwRdAT0yRuThMhwkdGOuU=
-github.com/googleapis/api-linter v1.65.0/go.mod h1:wSzDJv72pSiqFxUBoUop3Hx19tv6OEsnpe52A/k/0ig=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 h1:/c3QmbOGMGTOumP2iT/rCwB7b0QDGLKzqOmktBjT+Is=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1/go.mod h1:5SN9VR2LTsRFsrEC6FHgRbTWrTHu6tqPeKxEQv15giM=
-github.com/jhump/protoreflect v1.15.6 h1:WMYJbw2Wo+KOWwZFvgY0jMoVHM6i4XIvRs2RcBj5VmI=
-github.com/jhump/protoreflect v1.15.6/go.mod h1:jCHoyYQIJnaabEYnbGwyo9hUqfyUMTbJw/tAut5t97E=
+github.com/googleapis/api-linter v1.67.1 h1:4w5XrUGU/yGHJtk1J+DsHFtVshbRISvVHhB1ZjdZ2Qg=
+github.com/googleapis/api-linter v1.67.1/go.mod h1:FXkj1Z78//S3ydG9T9fUnw3F6wdFo/V5RUiAxhJfAvw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.21.0 h1:CWyXh/jylQWp2dtiV33mY4iSSp6yf4lmn+c7/tN+ObI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.21.0/go.mod h1:nCLIt0w3Ept2NwF8ThLmrppXsfT07oC8k0XNDxd8sVU=
+github.com/jhump/protoreflect v1.16.0 h1:54fZg+49widqXYQ0b+usAFHbMkBGR4PpXrsHc8+TBDg=
+github.com/jhump/protoreflect v1.16.0/go.mod h1:oYPd7nPvcBw/5wlDfm/AVmU9zH9BgqGCI469pGxfj/8=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -46,33 +46,31 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
-golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
-golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-google.golang.org/genproto v0.0.0-20240311173647-c811ad7063a7 h1:ImUcDPHjTrAqNhlOkSocDLfG9rrNHH7w7uoKWPaWZ8s=
-google.golang.org/genproto v0.0.0-20240311173647-c811ad7063a7/go.mod h1:/3XmxOjePkvmKrHuBy4zNFw7IzxJXtAgdpXi8Ll990U=
-google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa h1:Jt1XW5PaLXF1/ePZrznsh/aAUvI7Adfc3LY1dAKlzRs=
-google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa/go.mod h1:K4kfzHtI0kqWA79gecJarFtDn/Mls+GxQcg3Zox91Ac=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 h1:NnYq6UN9ReLM9/Y01KWNOWyI5xQ9kbIms5GGJVwS/Yc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
-google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=
-google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 h1:rNBFJjBCOgVr9pWD7rs/knKL4FRTKgpZmsRfV214zcA=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0/go.mod h1:Dk1tviKTvMCz5tvh7t+fh94dhmQVHuCt2OzJB3CTW9Y=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+google.golang.org/genproto v0.0.0-20240521202816-d264139d666e h1:axIBUGXSVho2zB+3tJj8l9Qvm/El5vVYPYqhGA5PmJM=
+google.golang.org/genproto v0.0.0-20240521202816-d264139d666e/go.mod h1:gOvX/2dWTqh+u3+IHjFeCxinlz5AZ5qhOufbQPub/dE=
+google.golang.org/genproto/googleapis/api v0.0.0-20240723171418-e6d459c13d2a h1:YIa/rzVqMEokBkPtydCkx1VLmv3An1Uw7w1P1m6EhOY=
+google.golang.org/genproto/googleapis/api v0.0.0-20240723171418-e6d459c13d2a/go.mod h1:AHT0dDg3SoMOgZGnZk29b5xTbPHMoEC8qthmBLJCpys=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240723171418-e6d459c13d2a h1:hqK4+jJZXCU4pW7jsAdGOVFIfLHQeV7LaizZKnZ84HI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240723171418-e6d459c13d2a/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
+google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/pkg/generated/protobuf/fulcio.pb.go b/pkg/generated/protobuf/fulcio.pb.go
index d1e1c7f..f8c21ad 100644
--- a/pkg/generated/protobuf/fulcio.pb.go
+++ b/pkg/generated/protobuf/fulcio.pb.go
@@ -15,8 +15,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
-// 	protoc        v4.25.1
+// 	protoc-gen-go v1.34.2
+// 	protoc        v4.23.1
 // source: fulcio.proto
 
 package protobuf
@@ -927,171 +927,171 @@ var file_fulcio_proto_rawDesc = []byte{
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x2d, 0x67, 0x65,
 	0x6e, 0x2d, 0x6f, 0x70, 0x65, 0x6e, 0x61, 0x70, 0x69, 0x76, 0x32, 0x2f, 0x6f, 0x70, 0x74, 0x69,
 	0x6f, 0x6e, 0x73, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x9a, 0x02, 0x0a, 0x1f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x9d, 0x02, 0x0a, 0x1f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
 	0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x4a, 0x0a, 0x0b, 0x63, 0x72, 0x65,
+	0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65,
 	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23,
 	0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75,
 	0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x73, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x61, 0x6c, 0x73, 0x12, 0x5d, 0x0a, 0x12, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
-	0x6b, 0x65, 0x79, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x03, 0xe0, 0x41, 0x02,
-	0x48, 0x00, 0x52, 0x10, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x45, 0x0a, 0x1b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
-	0x61, 0x74, 0x65, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x48, 0x00,
-	0x52, 0x19, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67,
-	0x6e, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x05, 0x0a, 0x03, 0x6b,
-	0x65, 0x79, 0x22, 0x4e, 0x0a, 0x0b, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x73, 0x12, 0x30, 0x0a, 0x13, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x74, 0x79, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
-	0x52, 0x11, 0x6f, 0x69, 0x64, 0x63, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x42, 0x0d, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
-	0x6c, 0x73, 0x22, 0x8e, 0x01, 0x0a, 0x10, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x45, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x64, 0x65,
-	0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69,
-	0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x42, 0x03,
-	0xe0, 0x41, 0x02, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x33,
-	0x0a, 0x13, 0x70, 0x72, 0x6f, 0x6f, 0x66, 0x5f, 0x6f, 0x66, 0x5f, 0x70, 0x6f, 0x73, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x03, 0xe0, 0x41, 0x02,
-	0x52, 0x11, 0x70, 0x72, 0x6f, 0x6f, 0x66, 0x4f, 0x66, 0x50, 0x6f, 0x73, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x22, 0x74, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
-	0x12, 0x48, 0x0a, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x52,
-	0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x1d, 0x0a, 0x07, 0x63, 0x6f,
-	0x6e, 0x74, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x02,
-	0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x22, 0xa3, 0x02, 0x0a, 0x12, 0x53, 0x69,
-	0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x12, 0x7e, 0x0a, 0x1f, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x64, 0x65, 0x74, 0x61, 0x63, 0x68, 0x65, 0x64, 0x5f,
-	0x73, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x64, 0x65, 0x76, 0x2e,
+	0x61, 0x6c, 0x73, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x12, 0x5e, 0x0a, 0x12, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72,
+	0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x04, 0xe2, 0x41,
+	0x01, 0x02, 0x48, 0x00, 0x52, 0x10, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x46, 0x0a, 0x1b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x04, 0xe2, 0x41, 0x01,
+	0x02, 0x48, 0x00, 0x52, 0x19, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x05,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x22, 0x4e, 0x0a, 0x0b, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x73, 0x12, 0x30, 0x0a, 0x13, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x69, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x48, 0x00, 0x52, 0x11, 0x6f, 0x69, 0x64, 0x63, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
+	0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x42, 0x0d, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x73, 0x22, 0x90, 0x01, 0x0a, 0x10, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x46, 0x0a, 0x0a, 0x70, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21,
+	0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75,
+	0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
+	0x79, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
+	0x65, 0x79, 0x12, 0x34, 0x0a, 0x13, 0x70, 0x72, 0x6f, 0x6f, 0x66, 0x5f, 0x6f, 0x66, 0x5f, 0x70,
+	0x6f, 0x73, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x42,
+	0x04, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x11, 0x70, 0x72, 0x6f, 0x6f, 0x66, 0x4f, 0x66, 0x50, 0x6f,
+	0x73, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x75, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x48, 0x0a, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74,
+	0x68, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73,
+	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76,
+	0x32, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x6f, 0x72,
+	0x69, 0x74, 0x68, 0x6d, 0x52, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12,
+	0x1e, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x04, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x22,
+	0xa3, 0x02, 0x0a, 0x12, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x7e, 0x0a, 0x1f, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64,
+	0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x64, 0x65, 0x74,
+	0x61, 0x63, 0x68, 0x65, 0x64, 0x5f, 0x73, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x35, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66,
+	0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67,
+	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x74, 0x61, 0x63,
+	0x68, 0x65, 0x64, 0x53, 0x43, 0x54, 0x48, 0x00, 0x52, 0x1c, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64,
+	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x74, 0x61, 0x63,
+	0x68, 0x65, 0x64, 0x53, 0x63, 0x74, 0x12, 0x7e, 0x0a, 0x1f, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64,
+	0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x6d, 0x62,
+	0x65, 0x64, 0x64, 0x65, 0x64, 0x5f, 0x73, 0x63, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x35, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66,
+	0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67,
+	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x62, 0x65, 0x64,
+	0x64, 0x65, 0x64, 0x53, 0x43, 0x54, 0x48, 0x00, 0x52, 0x1c, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64,
+	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x62, 0x65, 0x64,
+	0x64, 0x65, 0x64, 0x53, 0x63, 0x74, 0x42, 0x0d, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x22, 0xa1, 0x01, 0x0a, 0x1d, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e,
+	0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x74, 0x61,
+	0x63, 0x68, 0x65, 0x64, 0x53, 0x43, 0x54, 0x12, 0x3e, 0x0a, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e,
+	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e,
+	0x52, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x40, 0x0a, 0x1c, 0x73, 0x69, 0x67, 0x6e, 0x65,
+	0x64, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x1a, 0x73,
+	0x69, 0x67, 0x6e, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x22, 0x5f, 0x0a, 0x1d, 0x53, 0x69, 0x67,
+	0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x45,
+	0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x53, 0x43, 0x54, 0x12, 0x3e, 0x0a, 0x05, 0x63, 0x68,
+	0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e,
 	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e,
-	0x76, 0x32, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x74, 0x61, 0x63, 0x68, 0x65, 0x64, 0x53, 0x43, 0x54,
-	0x48, 0x00, 0x52, 0x1c, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x74, 0x61, 0x63, 0x68, 0x65, 0x64, 0x53, 0x63, 0x74,
-	0x12, 0x7e, 0x0a, 0x1f, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x5f,
-	0x73, 0x63, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x64, 0x65, 0x76, 0x2e,
+	0x76, 0x32, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68,
+	0x61, 0x69, 0x6e, 0x52, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x22, 0x17, 0x0a, 0x15, 0x47, 0x65,
+	0x74, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x22, 0x4f, 0x0a, 0x0b, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64,
+	0x6c, 0x65, 0x12, 0x40, 0x0a, 0x06, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72,
+	0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x65, 0x72, 0x74,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x52, 0x06, 0x63, 0x68,
+	0x61, 0x69, 0x6e, 0x73, 0x22, 0x36, 0x0a, 0x10, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x63, 0x65, 0x72, 0x74,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c,
+	0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x22, 0x19, 0x0a, 0x17,
+	0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x4d, 0x0a, 0x0d, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3c, 0x0a, 0x07, 0x69, 0x73, 0x73, 0x75,
+	0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e,
 	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e,
-	0x76, 0x32, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x53, 0x43, 0x54,
-	0x48, 0x00, 0x52, 0x1c, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x53, 0x63, 0x74,
-	0x42, 0x0d, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x22,
-	0xa1, 0x01, 0x0a, 0x1d, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x44, 0x65, 0x74, 0x61, 0x63, 0x68, 0x65, 0x64, 0x53, 0x43,
-	0x54, 0x12, 0x3e, 0x0a, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e,
-	0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x52, 0x05, 0x63, 0x68, 0x61, 0x69,
-	0x6e, 0x12, 0x40, 0x0a, 0x1c, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x5f, 0x63, 0x65, 0x72, 0x74,
-	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
-	0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x1a, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x43,
-	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
-	0x61, 0x6d, 0x70, 0x22, 0x5f, 0x0a, 0x1d, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65,
-	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x45, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65,
-	0x64, 0x53, 0x43, 0x54, 0x12, 0x3e, 0x0a, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x65, 0x72,
-	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x52, 0x05, 0x63,
-	0x68, 0x61, 0x69, 0x6e, 0x22, 0x17, 0x0a, 0x15, 0x47, 0x65, 0x74, 0x54, 0x72, 0x75, 0x73, 0x74,
-	0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x4f, 0x0a,
-	0x0b, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x12, 0x40, 0x0a, 0x06,
-	0x63, 0x68, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x64,
+	0x76, 0x32, 0x2e, 0x4f, 0x49, 0x44, 0x43, 0x49, 0x73, 0x73, 0x75, 0x65, 0x72, 0x52, 0x07, 0x69,
+	0x73, 0x73, 0x75, 0x65, 0x72, 0x73, 0x22, 0xde, 0x01, 0x0a, 0x0a, 0x4f, 0x49, 0x44, 0x43, 0x49,
+	0x73, 0x73, 0x75, 0x65, 0x72, 0x12, 0x1f, 0x0a, 0x0a, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x5f,
+	0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x69, 0x73, 0x73,
+	0x75, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x12, 0x30, 0x0a, 0x13, 0x77, 0x69, 0x6c, 0x64, 0x63, 0x61,
+	0x72, 0x64, 0x5f, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x11, 0x77, 0x69, 0x6c, 0x64, 0x63, 0x61, 0x72, 0x64, 0x49,
+	0x73, 0x73, 0x75, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x75, 0x64, 0x69,
+	0x65, 0x6e, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x75, 0x64, 0x69,
+	0x65, 0x6e, 0x63, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
+	0x65, 0x5f, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63,
+	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x2e, 0x0a,
+	0x13, 0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x5f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x5f, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x73, 0x70, 0x69, 0x66,
+	0x66, 0x65, 0x54, 0x72, 0x75, 0x73, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x42, 0x08, 0x0a,
+	0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x2a, 0x5f, 0x0a, 0x12, 0x50, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x24, 0x0a,
+	0x20, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x4f,
+	0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45,
+	0x44, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x52, 0x53, 0x41, 0x5f, 0x50, 0x53, 0x53, 0x10, 0x01,
+	0x12, 0x09, 0x0a, 0x05, 0x45, 0x43, 0x44, 0x53, 0x41, 0x10, 0x02, 0x12, 0x0b, 0x0a, 0x07, 0x45,
+	0x44, 0x32, 0x35, 0x35, 0x31, 0x39, 0x10, 0x03, 0x32, 0xb6, 0x03, 0x0a, 0x02, 0x43, 0x41, 0x12,
+	0x9f, 0x01, 0x0a, 0x18, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e,
+	0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x37, 0x2e, 0x64,
 	0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63,
-	0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x52, 0x06, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x73, 0x22, 0x36,
-	0x0a, 0x10, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61,
-	0x69, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x22, 0x19, 0x0a, 0x17, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x22, 0x4d, 0x0a, 0x0d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x3c, 0x0a, 0x07, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x4f, 0x49, 0x44,
-	0x43, 0x49, 0x73, 0x73, 0x75, 0x65, 0x72, 0x52, 0x07, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x73,
-	0x22, 0xde, 0x01, 0x0a, 0x0a, 0x4f, 0x49, 0x44, 0x43, 0x49, 0x73, 0x73, 0x75, 0x65, 0x72, 0x12,
-	0x1f, 0x0a, 0x0a, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x55, 0x72, 0x6c,
-	0x12, 0x30, 0x0a, 0x13, 0x77, 0x69, 0x6c, 0x64, 0x63, 0x61, 0x72, 0x64, 0x5f, 0x69, 0x73, 0x73,
-	0x75, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52,
-	0x11, 0x77, 0x69, 0x6c, 0x64, 0x63, 0x61, 0x72, 0x64, 0x49, 0x73, 0x73, 0x75, 0x65, 0x72, 0x55,
-	0x72, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x27,
-	0x0a, 0x0f, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x63, 0x6c, 0x61, 0x69,
-	0x6d, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e,
-	0x67, 0x65, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x2e, 0x0a, 0x13, 0x73, 0x70, 0x69, 0x66, 0x66,
-	0x65, 0x5f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x05,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x54, 0x72, 0x75, 0x73,
-	0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x42, 0x08, 0x0a, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65,
-	0x72, 0x2a, 0x5f, 0x0a, 0x12, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c,
-	0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x24, 0x0a, 0x20, 0x50, 0x55, 0x42, 0x4c, 0x49,
-	0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f,
-	0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0b, 0x0a,
-	0x07, 0x52, 0x53, 0x41, 0x5f, 0x50, 0x53, 0x53, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x43,
-	0x44, 0x53, 0x41, 0x10, 0x02, 0x12, 0x0b, 0x0a, 0x07, 0x45, 0x44, 0x32, 0x35, 0x35, 0x31, 0x39,
-	0x10, 0x03, 0x32, 0xb6, 0x03, 0x0a, 0x02, 0x43, 0x41, 0x12, 0x9f, 0x01, 0x0a, 0x18, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x37, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72,
-	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x2a, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66,
-	0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67,
-	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x22, 0x1e, 0x82, 0xd3, 0xe4,
-	0x93, 0x02, 0x18, 0x3a, 0x01, 0x2a, 0x22, 0x13, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x32, 0x2f,
-	0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x12, 0x81, 0x01, 0x0a, 0x0e,
-	0x47, 0x65, 0x74, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x12, 0x2d,
-	0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75,
-	0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x72, 0x75, 0x73, 0x74,
-	0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e,
-	0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c,
-	0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64,
-	0x6c, 0x65, 0x22, 0x1b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15, 0x12, 0x13, 0x2f, 0x61, 0x70, 0x69,
-	0x2f, 0x76, 0x32, 0x2f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x12,
-	0x89, 0x01, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74,
+	0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e,
+	0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
+	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x53,
+	0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x22, 0x1e, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x18, 0x3a, 0x01, 0x2a, 0x22, 0x13, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x76, 0x32, 0x2f, 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72,
+	0x74, 0x12, 0x81, 0x01, 0x0a, 0x0e, 0x47, 0x65, 0x74, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75,
+	0x6e, 0x64, 0x6c, 0x65, 0x12, 0x2d, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74,
 	0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65,
-	0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x1d, 0x82, 0xd3,
-	0xe4, 0x93, 0x02, 0x17, 0x12, 0x15, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x32, 0x2f, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x8f, 0x03, 0x92, 0x41,
-	0xb1, 0x02, 0x12, 0xb9, 0x01, 0x0a, 0x06, 0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x22, 0x5c, 0x0a,
-	0x17, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x20, 0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f,
-	0x20, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x22, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a,
-	0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x1a, 0x1d, 0x73, 0x69,
-	0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2d, 0x64, 0x65, 0x76, 0x40, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x2a, 0x4a, 0x0a, 0x12, 0x41,
-	0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4c, 0x69, 0x63, 0x65, 0x6e, 0x73, 0x65, 0x20, 0x32, 0x2e,
-	0x30, 0x12, 0x34, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66,
-	0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2f, 0x62, 0x6c, 0x6f, 0x62, 0x2f, 0x6d, 0x61, 0x69, 0x6e, 0x2f,
-	0x4c, 0x49, 0x43, 0x45, 0x4e, 0x53, 0x45, 0x32, 0x05, 0x32, 0x2e, 0x30, 0x2e, 0x30, 0x1a, 0x13,
-	0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e,
-	0x64, 0x65, 0x76, 0x2a, 0x01, 0x01, 0x32, 0x10, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x2f, 0x6a, 0x73, 0x6f, 0x6e, 0x3a, 0x10, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x6a, 0x73, 0x6f, 0x6e, 0x72, 0x37, 0x0a, 0x11, 0x4d, 0x6f,
-	0x72, 0x65, 0x20, 0x61, 0x62, 0x6f, 0x75, 0x74, 0x20, 0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x12,
-	0x22, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c,
-	0x63, 0x69, 0x6f, 0x0a, 0x16, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72,
-	0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x42, 0x0b, 0x46, 0x75, 0x6c,
-	0x63, 0x69, 0x6f, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x31, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f,
-	0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x65, 0x72,
-	0x61, 0x74, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
+	0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x54, 0x72, 0x75,
+	0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x22, 0x1b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15,
+	0x12, 0x13, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x32, 0x2f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x42,
+	0x75, 0x6e, 0x64, 0x6c, 0x65, 0x12, 0x89, 0x01, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x2e, 0x64, 0x65, 0x76,
+	0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f,
+	0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x64, 0x65,
+	0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69,
+	0x6f, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x22, 0x1d, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x17, 0x12, 0x15, 0x2f, 0x61, 0x70, 0x69,
+	0x2f, 0x76, 0x32, 0x2f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x42, 0x8f, 0x03, 0x92, 0x41, 0xb1, 0x02, 0x12, 0xb9, 0x01, 0x0a, 0x06, 0x46, 0x75, 0x6c,
+	0x63, 0x69, 0x6f, 0x22, 0x5c, 0x0a, 0x17, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x20,
+	0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x20, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x22,
+	0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63,
+	0x69, 0x6f, 0x1a, 0x1d, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2d, 0x64, 0x65, 0x76,
+	0x40, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2a, 0x4a, 0x0a, 0x12, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4c, 0x69, 0x63, 0x65,
+	0x6e, 0x73, 0x65, 0x20, 0x32, 0x2e, 0x30, 0x12, 0x34, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f,
+	0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73,
+	0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2f, 0x62, 0x6c, 0x6f, 0x62,
+	0x2f, 0x6d, 0x61, 0x69, 0x6e, 0x2f, 0x4c, 0x49, 0x43, 0x45, 0x4e, 0x53, 0x45, 0x32, 0x05, 0x32,
+	0x2e, 0x30, 0x2e, 0x30, 0x1a, 0x13, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x73, 0x69, 0x67,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x65, 0x76, 0x2a, 0x01, 0x01, 0x32, 0x10, 0x61, 0x70,
+	0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x6a, 0x73, 0x6f, 0x6e, 0x3a, 0x10,
+	0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x6a, 0x73, 0x6f, 0x6e,
+	0x72, 0x37, 0x0a, 0x11, 0x4d, 0x6f, 0x72, 0x65, 0x20, 0x61, 0x62, 0x6f, 0x75, 0x74, 0x20, 0x46,
+	0x75, 0x6c, 0x63, 0x69, 0x6f, 0x12, 0x22, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
+	0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x0a, 0x16, 0x64, 0x65, 0x76, 0x2e, 0x73,
+	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76,
+	0x32, 0x42, 0x0b, 0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x31, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2f, 0x70, 0x6b, 0x67,
+	0x2f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1108,7 +1108,7 @@ func file_fulcio_proto_rawDescGZIP() []byte {
 
 var file_fulcio_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
 var file_fulcio_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
-var file_fulcio_proto_goTypes = []interface{}{
+var file_fulcio_proto_goTypes = []any{
 	(PublicKeyAlgorithm)(0),                 // 0: dev.sigstore.fulcio.v2.PublicKeyAlgorithm
 	(*CreateSigningCertificateRequest)(nil), // 1: dev.sigstore.fulcio.v2.CreateSigningCertificateRequest
 	(*Credentials)(nil),                     // 2: dev.sigstore.fulcio.v2.Credentials
@@ -1154,7 +1154,7 @@ func file_fulcio_proto_init() {
 		return
 	}
 	if !protoimpl.UnsafeEnabled {
-		file_fulcio_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[0].Exporter = func(v any, i int) any {
 			switch v := v.(*CreateSigningCertificateRequest); i {
 			case 0:
 				return &v.state
@@ -1166,7 +1166,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[1].Exporter = func(v any, i int) any {
 			switch v := v.(*Credentials); i {
 			case 0:
 				return &v.state
@@ -1178,7 +1178,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[2].Exporter = func(v any, i int) any {
 			switch v := v.(*PublicKeyRequest); i {
 			case 0:
 				return &v.state
@@ -1190,7 +1190,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[3].Exporter = func(v any, i int) any {
 			switch v := v.(*PublicKey); i {
 			case 0:
 				return &v.state
@@ -1202,7 +1202,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[4].Exporter = func(v any, i int) any {
 			switch v := v.(*SigningCertificate); i {
 			case 0:
 				return &v.state
@@ -1214,7 +1214,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[5].Exporter = func(v any, i int) any {
 			switch v := v.(*SigningCertificateDetachedSCT); i {
 			case 0:
 				return &v.state
@@ -1226,7 +1226,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[6].Exporter = func(v any, i int) any {
 			switch v := v.(*SigningCertificateEmbeddedSCT); i {
 			case 0:
 				return &v.state
@@ -1238,7 +1238,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[7].Exporter = func(v any, i int) any {
 			switch v := v.(*GetTrustBundleRequest); i {
 			case 0:
 				return &v.state
@@ -1250,7 +1250,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[8].Exporter = func(v any, i int) any {
 			switch v := v.(*TrustBundle); i {
 			case 0:
 				return &v.state
@@ -1262,7 +1262,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[9].Exporter = func(v any, i int) any {
 			switch v := v.(*CertificateChain); i {
 			case 0:
 				return &v.state
@@ -1274,7 +1274,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[10].Exporter = func(v any, i int) any {
 			switch v := v.(*GetConfigurationRequest); i {
 			case 0:
 				return &v.state
@@ -1286,7 +1286,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[11].Exporter = func(v any, i int) any {
 			switch v := v.(*Configuration); i {
 			case 0:
 				return &v.state
@@ -1298,7 +1298,7 @@ func file_fulcio_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_proto_msgTypes[12].Exporter = func(v any, i int) any {
 			switch v := v.(*OIDCIssuer); i {
 			case 0:
 				return &v.state
@@ -1311,18 +1311,18 @@ func file_fulcio_proto_init() {
 			}
 		}
 	}
-	file_fulcio_proto_msgTypes[0].OneofWrappers = []interface{}{
+	file_fulcio_proto_msgTypes[0].OneofWrappers = []any{
 		(*CreateSigningCertificateRequest_PublicKeyRequest)(nil),
 		(*CreateSigningCertificateRequest_CertificateSigningRequest)(nil),
 	}
-	file_fulcio_proto_msgTypes[1].OneofWrappers = []interface{}{
+	file_fulcio_proto_msgTypes[1].OneofWrappers = []any{
 		(*Credentials_OidcIdentityToken)(nil),
 	}
-	file_fulcio_proto_msgTypes[4].OneofWrappers = []interface{}{
+	file_fulcio_proto_msgTypes[4].OneofWrappers = []any{
 		(*SigningCertificate_SignedCertificateDetachedSct)(nil),
 		(*SigningCertificate_SignedCertificateEmbeddedSct)(nil),
 	}
-	file_fulcio_proto_msgTypes[12].OneofWrappers = []interface{}{
+	file_fulcio_proto_msgTypes[12].OneofWrappers = []any{
 		(*OIDCIssuer_IssuerUrl)(nil),
 		(*OIDCIssuer_WildcardIssuerUrl)(nil),
 	}
diff --git a/pkg/generated/protobuf/fulcio.pb.gw.go b/pkg/generated/protobuf/fulcio.pb.gw.go
index 93ad4f5..2500e0c 100644
--- a/pkg/generated/protobuf/fulcio.pb.gw.go
+++ b/pkg/generated/protobuf/fulcio.pb.gw.go
@@ -97,6 +97,7 @@ func local_request_CA_GetConfiguration_0(ctx context.Context, marshaler runtime.
 // UnaryRPC     :call CAServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterCAHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
 func RegisterCAHandlerServer(ctx context.Context, mux *runtime.ServeMux, server CAServer) error {
 
 	mux.Handle("POST", pattern_CA_CreateSigningCertificate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -180,21 +181,21 @@ func RegisterCAHandlerServer(ctx context.Context, mux *runtime.ServeMux, server
 // RegisterCAHandlerFromEndpoint is same as RegisterCAHandler but
 // automatically dials to "endpoint" and closes the connection when "ctx" gets done.
 func RegisterCAHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
-	conn, err := grpc.DialContext(ctx, endpoint, opts...)
+	conn, err := grpc.NewClient(endpoint, opts...)
 	if err != nil {
 		return err
 	}
 	defer func() {
 		if err != nil {
 			if cerr := conn.Close(); cerr != nil {
-				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
 			}
 			return
 		}
 		go func() {
 			<-ctx.Done()
 			if cerr := conn.Close(); cerr != nil {
-				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
 			}
 		}()
 	}()
@@ -212,7 +213,7 @@ func RegisterCAHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.Cl
 // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "CAClient".
 // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "CAClient"
 // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
-// "CAClient" to call the correct interceptors.
+// "CAClient" to call the correct interceptors. This client ignores the HTTP middlewares.
 func RegisterCAHandlerClient(ctx context.Context, mux *runtime.ServeMux, client CAClient) error {
 
 	mux.Handle("POST", pattern_CA_CreateSigningCertificate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
diff --git a/pkg/generated/protobuf/fulcio_grpc.pb.go b/pkg/generated/protobuf/fulcio_grpc.pb.go
index 986ee6e..96f6e1b 100644
--- a/pkg/generated/protobuf/fulcio_grpc.pb.go
+++ b/pkg/generated/protobuf/fulcio_grpc.pb.go
@@ -15,8 +15,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
-// - protoc             v4.25.1
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v4.23.1
 // source: fulcio.proto
 
 package protobuf
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	CA_CreateSigningCertificate_FullMethodName = "/dev.sigstore.fulcio.v2.CA/CreateSigningCertificate"
@@ -63,8 +63,9 @@ func NewCAClient(cc grpc.ClientConnInterface) CAClient {
 }
 
 func (c *cAClient) CreateSigningCertificate(ctx context.Context, in *CreateSigningCertificateRequest, opts ...grpc.CallOption) (*SigningCertificate, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SigningCertificate)
-	err := c.cc.Invoke(ctx, CA_CreateSigningCertificate_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CA_CreateSigningCertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -72,8 +73,9 @@ func (c *cAClient) CreateSigningCertificate(ctx context.Context, in *CreateSigni
 }
 
 func (c *cAClient) GetTrustBundle(ctx context.Context, in *GetTrustBundleRequest, opts ...grpc.CallOption) (*TrustBundle, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TrustBundle)
-	err := c.cc.Invoke(ctx, CA_GetTrustBundle_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CA_GetTrustBundle_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -81,8 +83,9 @@ func (c *cAClient) GetTrustBundle(ctx context.Context, in *GetTrustBundleRequest
 }
 
 func (c *cAClient) GetConfiguration(ctx context.Context, in *GetConfigurationRequest, opts ...grpc.CallOption) (*Configuration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Configuration)
-	err := c.cc.Invoke(ctx, CA_GetConfiguration_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CA_GetConfiguration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -91,7 +94,7 @@ func (c *cAClient) GetConfiguration(ctx context.Context, in *GetConfigurationReq
 
 // CAServer is the server API for CA service.
 // All implementations must embed UnimplementedCAServer
-// for forward compatibility
+// for forward compatibility.
 type CAServer interface {
 	// *
 	// Returns an X.509 certificate created by the Fulcio certificate authority for the given request parameters
@@ -105,9 +108,12 @@ type CAServer interface {
 	mustEmbedUnimplementedCAServer()
 }
 
-// UnimplementedCAServer must be embedded to have forward compatible implementations.
-type UnimplementedCAServer struct {
-}
+// UnimplementedCAServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedCAServer struct{}
 
 func (UnimplementedCAServer) CreateSigningCertificate(context.Context, *CreateSigningCertificateRequest) (*SigningCertificate, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateSigningCertificate not implemented")
@@ -119,6 +125,7 @@ func (UnimplementedCAServer) GetConfiguration(context.Context, *GetConfiguration
 	return nil, status.Errorf(codes.Unimplemented, "method GetConfiguration not implemented")
 }
 func (UnimplementedCAServer) mustEmbedUnimplementedCAServer() {}
+func (UnimplementedCAServer) testEmbeddedByValue()            {}
 
 // UnsafeCAServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to CAServer will
@@ -128,6 +135,13 @@ type UnsafeCAServer interface {
 }
 
 func RegisterCAServer(s grpc.ServiceRegistrar, srv CAServer) {
+	// If the following call pancis, it indicates UnimplementedCAServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&CA_ServiceDesc, srv)
 }
 
diff --git a/pkg/generated/protobuf/legacy/fulcio_legacy.pb.go b/pkg/generated/protobuf/legacy/fulcio_legacy.pb.go
index 4970f61..c0ab3e4 100644
--- a/pkg/generated/protobuf/legacy/fulcio_legacy.pb.go
+++ b/pkg/generated/protobuf/legacy/fulcio_legacy.pb.go
@@ -15,8 +15,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
-// 	protoc        v4.25.1
+// 	protoc-gen-go v1.34.2
+// 	protoc        v4.23.1
 // source: fulcio_legacy.proto
 
 package legacy
@@ -201,69 +201,69 @@ var file_fulcio_legacy_proto_rawDesc = []byte{
 	0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63,
 	0x2d, 0x67, 0x65, 0x6e, 0x2d, 0x6f, 0x70, 0x65, 0x6e, 0x61, 0x70, 0x69, 0x76, 0x32, 0x2f, 0x6f,
 	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe9, 0x01, 0x0a, 0x1f, 0x43, 0x72, 0x65,
+	0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xec, 0x01, 0x0a, 0x1f, 0x43, 0x72, 0x65,
 	0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x4a, 0x0a, 0x09,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x4b, 0x0a, 0x09,
 	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x25, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66,
 	0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x2e, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x42, 0x05, 0xe0, 0x41, 0x01, 0x18, 0x01, 0x52, 0x09, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x35, 0x0a, 0x12, 0x73, 0x69, 0x67, 0x6e,
-	0x65, 0x64, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0c, 0x42, 0x05, 0xe0, 0x41, 0x01, 0x18, 0x01, 0x52, 0x12, 0x73, 0x69, 0x67,
-	0x6e, 0x65, 0x64, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12,
-	0x43, 0x0a, 0x19, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x53, 0x69,
-	0x67, 0x6e, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0c, 0x42, 0x05, 0xe0, 0x41, 0x01, 0x18, 0x01, 0x52, 0x19, 0x63, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x22, 0x4e, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x12, 0x20, 0x0a, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69,
-	0x74, 0x68, 0x6d, 0x12, 0x1f, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0c, 0x42, 0x05, 0xe0, 0x41, 0x02, 0x18, 0x01, 0x52, 0x07, 0x63, 0x6f, 0x6e,
-	0x74, 0x65, 0x6e, 0x74, 0x32, 0xf8, 0x01, 0x0a, 0x02, 0x43, 0x41, 0x12, 0x90, 0x01, 0x0a, 0x18,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72,
-	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x3b, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73,
-	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76,
-	0x31, 0x62, 0x65, 0x74, 0x61, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e,
-	0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x42, 0x6f, 0x64, 0x79, 0x22, 0x21, 0x82, 0xd3, 0xe4,
-	0x93, 0x02, 0x18, 0x3a, 0x01, 0x2a, 0x22, 0x13, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f,
-	0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x88, 0x02, 0x01, 0x12, 0x5f,
-	0x0a, 0x12, 0x47, 0x65, 0x74, 0x52, 0x6f, 0x6f, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x14, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x42, 0x6f,
-	0x64, 0x79, 0x22, 0x1b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x12, 0x12, 0x10, 0x2f, 0x61, 0x70, 0x69,
-	0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x6f, 0x74, 0x43, 0x65, 0x72, 0x74, 0x88, 0x02, 0x01, 0x42,
-	0xa1, 0x03, 0x92, 0x41, 0xb8, 0x02, 0x12, 0xc0, 0x01, 0x0a, 0x0d, 0x46, 0x75, 0x6c, 0x63, 0x69,
-	0x6f, 0x20, 0x4c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x22, 0x5c, 0x0a, 0x17, 0x73, 0x69, 0x67, 0x73,
-	0x74, 0x6f, 0x72, 0x65, 0x20, 0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x20, 0x70, 0x72, 0x6f, 0x6a,
-	0x65, 0x63, 0x74, 0x12, 0x22, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2f, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x1a, 0x1d, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72,
-	0x65, 0x2d, 0x64, 0x65, 0x76, 0x40, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x67, 0x72, 0x6f, 0x75,
-	0x70, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x2a, 0x4a, 0x0a, 0x12, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65,
-	0x20, 0x4c, 0x69, 0x63, 0x65, 0x6e, 0x73, 0x65, 0x20, 0x32, 0x2e, 0x30, 0x12, 0x34, 0x68, 0x74,
-	0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f,
-	0x2f, 0x62, 0x6c, 0x6f, 0x62, 0x2f, 0x6d, 0x61, 0x69, 0x6e, 0x2f, 0x4c, 0x49, 0x43, 0x45, 0x4e,
-	0x53, 0x45, 0x32, 0x05, 0x31, 0x2e, 0x30, 0x2e, 0x30, 0x1a, 0x13, 0x66, 0x75, 0x6c, 0x63, 0x69,
-	0x6f, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x65, 0x76, 0x2a, 0x01,
-	0x01, 0x32, 0x10, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x6a,
-	0x73, 0x6f, 0x6e, 0x3a, 0x10, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x2f, 0x6a, 0x73, 0x6f, 0x6e, 0x72, 0x37, 0x0a, 0x11, 0x4d, 0x6f, 0x72, 0x65, 0x20, 0x61, 0x62,
-	0x6f, 0x75, 0x74, 0x20, 0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x12, 0x22, 0x68, 0x74, 0x74, 0x70,
-	0x73, 0x3a, 0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73,
-	0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x0a, 0x1a,
-	0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c,
-	0x63, 0x69, 0x6f, 0x2e, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x42, 0x0b, 0x46, 0x75, 0x6c, 0x63,
-	0x69, 0x6f, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x38, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66,
-	0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61,
-	0x74, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x6c, 0x65, 0x67,
-	0x61, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x42, 0x06, 0xe2, 0x41, 0x01, 0x01, 0x18, 0x01, 0x52, 0x09,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x36, 0x0a, 0x12, 0x73, 0x69, 0x67,
+	0x6e, 0x65, 0x64, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x06, 0xe2, 0x41, 0x01, 0x01, 0x18, 0x01, 0x52, 0x12, 0x73,
+	0x69, 0x67, 0x6e, 0x65, 0x64, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73,
+	0x73, 0x12, 0x44, 0x0a, 0x19, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0c, 0x42, 0x06, 0xe2, 0x41, 0x01, 0x01, 0x18, 0x01, 0x52, 0x19, 0x63, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x4f, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x4b, 0x65, 0x79, 0x12, 0x20, 0x0a, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68,
+	0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x09, 0x61, 0x6c, 0x67,
+	0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x20, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e,
+	0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x06, 0xe2, 0x41, 0x01, 0x02, 0x18, 0x01, 0x52,
+	0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x32, 0xf8, 0x01, 0x0a, 0x02, 0x43, 0x41, 0x12,
+	0x90, 0x01, 0x0a, 0x18, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e,
+	0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x3b, 0x2e, 0x64,
+	0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x66, 0x75, 0x6c, 0x63,
+	0x69, 0x6f, 0x2e, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x42, 0x6f, 0x64, 0x79, 0x22,
+	0x21, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x18, 0x3a, 0x01, 0x2a, 0x22, 0x13, 0x2f, 0x61, 0x70, 0x69,
+	0x2f, 0x76, 0x31, 0x2f, 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x65, 0x72, 0x74, 0x88,
+	0x02, 0x01, 0x12, 0x5f, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x52, 0x6f, 0x6f, 0x74, 0x43, 0x65, 0x72,
+	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
+	0x1a, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x48, 0x74,
+	0x74, 0x70, 0x42, 0x6f, 0x64, 0x79, 0x22, 0x1b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x12, 0x12, 0x10,
+	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x6f, 0x6f, 0x74, 0x43, 0x65, 0x72, 0x74,
+	0x88, 0x02, 0x01, 0x42, 0xa1, 0x03, 0x92, 0x41, 0xb8, 0x02, 0x12, 0xc0, 0x01, 0x0a, 0x0d, 0x46,
+	0x75, 0x6c, 0x63, 0x69, 0x6f, 0x20, 0x4c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x22, 0x5c, 0x0a, 0x17,
+	0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x20, 0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x20,
+	0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x22, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f,
+	0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73,
+	0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x1a, 0x1d, 0x73, 0x69, 0x67,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x2d, 0x64, 0x65, 0x76, 0x40, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x2a, 0x4a, 0x0a, 0x12, 0x41, 0x70,
+	0x61, 0x63, 0x68, 0x65, 0x20, 0x4c, 0x69, 0x63, 0x65, 0x6e, 0x73, 0x65, 0x20, 0x32, 0x2e, 0x30,
+	0x12, 0x34, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75,
+	0x6c, 0x63, 0x69, 0x6f, 0x2f, 0x62, 0x6c, 0x6f, 0x62, 0x2f, 0x6d, 0x61, 0x69, 0x6e, 0x2f, 0x4c,
+	0x49, 0x43, 0x45, 0x4e, 0x53, 0x45, 0x32, 0x05, 0x31, 0x2e, 0x30, 0x2e, 0x30, 0x1a, 0x13, 0x66,
+	0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x64,
+	0x65, 0x76, 0x2a, 0x01, 0x01, 0x32, 0x10, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x2f, 0x6a, 0x73, 0x6f, 0x6e, 0x3a, 0x10, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x6a, 0x73, 0x6f, 0x6e, 0x72, 0x37, 0x0a, 0x11, 0x4d, 0x6f, 0x72,
+	0x65, 0x20, 0x61, 0x62, 0x6f, 0x75, 0x74, 0x20, 0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x12, 0x22,
+	0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63,
+	0x69, 0x6f, 0x0a, 0x1a, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65,
+	0x2e, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2e, 0x76, 0x31, 0x62, 0x65, 0x74, 0x61, 0x42, 0x0b,
+	0x46, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x38, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f,
+	0x72, 0x65, 0x2f, 0x66, 0x75, 0x6c, 0x63, 0x69, 0x6f, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65,
+	0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2f, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -279,7 +279,7 @@ func file_fulcio_legacy_proto_rawDescGZIP() []byte {
 }
 
 var file_fulcio_legacy_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_fulcio_legacy_proto_goTypes = []interface{}{
+var file_fulcio_legacy_proto_goTypes = []any{
 	(*CreateSigningCertificateRequest)(nil), // 0: dev.sigstore.fulcio.v1beta.CreateSigningCertificateRequest
 	(*PublicKey)(nil),                       // 1: dev.sigstore.fulcio.v1beta.PublicKey
 	(*emptypb.Empty)(nil),                   // 2: google.protobuf.Empty
@@ -304,7 +304,7 @@ func file_fulcio_legacy_proto_init() {
 		return
 	}
 	if !protoimpl.UnsafeEnabled {
-		file_fulcio_legacy_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_legacy_proto_msgTypes[0].Exporter = func(v any, i int) any {
 			switch v := v.(*CreateSigningCertificateRequest); i {
 			case 0:
 				return &v.state
@@ -316,7 +316,7 @@ func file_fulcio_legacy_proto_init() {
 				return nil
 			}
 		}
-		file_fulcio_legacy_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+		file_fulcio_legacy_proto_msgTypes[1].Exporter = func(v any, i int) any {
 			switch v := v.(*PublicKey); i {
 			case 0:
 				return &v.state
diff --git a/pkg/generated/protobuf/legacy/fulcio_legacy.pb.gw.go b/pkg/generated/protobuf/legacy/fulcio_legacy.pb.gw.go
index 62ea4de..91a24cd 100644
--- a/pkg/generated/protobuf/legacy/fulcio_legacy.pb.gw.go
+++ b/pkg/generated/protobuf/legacy/fulcio_legacy.pb.gw.go
@@ -80,6 +80,7 @@ func local_request_CA_GetRootCertificate_0(ctx context.Context, marshaler runtim
 // UnaryRPC     :call CAServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterCAHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
 func RegisterCAHandlerServer(ctx context.Context, mux *runtime.ServeMux, server CAServer) error {
 
 	mux.Handle("POST", pattern_CA_CreateSigningCertificate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -138,21 +139,21 @@ func RegisterCAHandlerServer(ctx context.Context, mux *runtime.ServeMux, server
 // RegisterCAHandlerFromEndpoint is same as RegisterCAHandler but
 // automatically dials to "endpoint" and closes the connection when "ctx" gets done.
 func RegisterCAHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
-	conn, err := grpc.DialContext(ctx, endpoint, opts...)
+	conn, err := grpc.NewClient(endpoint, opts...)
 	if err != nil {
 		return err
 	}
 	defer func() {
 		if err != nil {
 			if cerr := conn.Close(); cerr != nil {
-				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
 			}
 			return
 		}
 		go func() {
 			<-ctx.Done()
 			if cerr := conn.Close(); cerr != nil {
-				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
 			}
 		}()
 	}()
@@ -170,7 +171,7 @@ func RegisterCAHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.Cl
 // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "CAClient".
 // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "CAClient"
 // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
-// "CAClient" to call the correct interceptors.
+// "CAClient" to call the correct interceptors. This client ignores the HTTP middlewares.
 func RegisterCAHandlerClient(ctx context.Context, mux *runtime.ServeMux, client CAClient) error {
 
 	mux.Handle("POST", pattern_CA_CreateSigningCertificate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
diff --git a/pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go b/pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go
index 05b94ad..3a251af 100644
--- a/pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go
+++ b/pkg/generated/protobuf/legacy/fulcio_legacy_grpc.pb.go
@@ -15,8 +15,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
-// - protoc             v4.25.1
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v4.23.1
 // source: fulcio_legacy.proto
 
 package legacy
@@ -32,8 +32,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	CA_CreateSigningCertificate_FullMethodName = "/dev.sigstore.fulcio.v1beta.CA/CreateSigningCertificate"
@@ -43,6 +43,9 @@ const (
 // CAClient is the client API for CA service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// This implements the pre-GA HTTP-based Fulcio API.
+// This interface is deprecated and will only receive backports of security-related features - clients should prefer the GA GRPC interface!
 type CAClient interface {
 	// Deprecated: Do not use.
 	//
@@ -64,8 +67,9 @@ func NewCAClient(cc grpc.ClientConnInterface) CAClient {
 
 // Deprecated: Do not use.
 func (c *cAClient) CreateSigningCertificate(ctx context.Context, in *CreateSigningCertificateRequest, opts ...grpc.CallOption) (*httpbody.HttpBody, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(httpbody.HttpBody)
-	err := c.cc.Invoke(ctx, CA_CreateSigningCertificate_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CA_CreateSigningCertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -74,8 +78,9 @@ func (c *cAClient) CreateSigningCertificate(ctx context.Context, in *CreateSigni
 
 // Deprecated: Do not use.
 func (c *cAClient) GetRootCertificate(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*httpbody.HttpBody, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(httpbody.HttpBody)
-	err := c.cc.Invoke(ctx, CA_GetRootCertificate_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CA_GetRootCertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -84,7 +89,10 @@ func (c *cAClient) GetRootCertificate(ctx context.Context, in *emptypb.Empty, op
 
 // CAServer is the server API for CA service.
 // All implementations must embed UnimplementedCAServer
-// for forward compatibility
+// for forward compatibility.
+//
+// This implements the pre-GA HTTP-based Fulcio API.
+// This interface is deprecated and will only receive backports of security-related features - clients should prefer the GA GRPC interface!
 type CAServer interface {
 	// Deprecated: Do not use.
 	//
@@ -97,9 +105,12 @@ type CAServer interface {
 	mustEmbedUnimplementedCAServer()
 }
 
-// UnimplementedCAServer must be embedded to have forward compatible implementations.
-type UnimplementedCAServer struct {
-}
+// UnimplementedCAServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedCAServer struct{}
 
 func (UnimplementedCAServer) CreateSigningCertificate(context.Context, *CreateSigningCertificateRequest) (*httpbody.HttpBody, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateSigningCertificate not implemented")
@@ -108,6 +119,7 @@ func (UnimplementedCAServer) GetRootCertificate(context.Context, *emptypb.Empty)
 	return nil, status.Errorf(codes.Unimplemented, "method GetRootCertificate not implemented")
 }
 func (UnimplementedCAServer) mustEmbedUnimplementedCAServer() {}
+func (UnimplementedCAServer) testEmbeddedByValue()            {}
 
 // UnsafeCAServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to CAServer will
@@ -117,6 +129,13 @@ type UnsafeCAServer interface {
 }
 
 func RegisterCAServer(s grpc.ServiceRegistrar, srv CAServer) {
+	// If the following call pancis, it indicates UnimplementedCAServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&CA_ServiceDesc, srv)
 }
 
diff --git a/pkg/identity/ciprovider/principal.go b/pkg/identity/ciprovider/principal.go
index fb94df3..dce9227 100644
--- a/pkg/identity/ciprovider/principal.go
+++ b/pkg/identity/ciprovider/principal.go
@@ -53,12 +53,12 @@ func applyTemplateOrReplace(extValueTemplate string, tokenClaims map[string]stri
 	// default data provided by the yaml file.
 	// The order here matter because we want to override the claimed data
 	// with the default data.
-	// The default data will have priority over the claimed data.
+	// The claimed data will have priority over the default data.
 	mergedData := make(map[string]string)
-	for k, v := range tokenClaims {
+	for k, v := range issuerMetadata {
 		mergedData[k] = v
 	}
-	for k, v := range issuerMetadata {
+	for k, v := range tokenClaims {
 		mergedData[k] = v
 	}
 


Test patch:
diff --git a/pkg/identity/ciprovider/principal_test.go b/pkg/identity/ciprovider/principal_test.go
index e60b216..4e51d06 100644
--- a/pkg/identity/ciprovider/principal_test.go
+++ b/pkg/identity/ciprovider/principal_test.go
@@ -233,9 +233,12 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 		"ref_gitlab":            "main",
 		"ref_type_tag":          "tag",
 		"ref_tag":               "1.0.0",
+		"claim_foo":             "bar",
 	}
 	issuerMetadata := map[string]string{
-		"url": "https://github.com",
+		"url":         "https://github.com",
+		"claim_foo":   "default",
+		"default_foo": "default_bar",
 	}
 
 	tests := map[string]struct {
@@ -283,6 +286,21 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 			ExpectedResult: "refs/tags/1.0.0",
 			ExpectErr:      false,
 		},
+		`Raise error for empty key in comparison`: {
+			Template:       `{{if eq . ""}}foo{{else}}bar{{end}}`,
+			ExpectedResult: "",
+			ExpectErr:      true,
+		},
+		`Should use default when claim doesn't exist`: {
+			Template:       "default_foo",
+			ExpectedResult: "default_bar",
+			ExpectErr:      false,
+		},
+		`Should prior claims over defaults when they has the same name`: {
+			Template:       "claim_foo",
+			ExpectedResult: "bar",
+			ExpectErr:      false,
+		},
 	}
 
 	for name, test := range tests {