Repository: sigstore/cosign
Pull request #2252 (2022-09-15 10:46:44)

Update e2e tests - update workflow to use workload identity instead of key
#### Summary
- update workflow to use workload identity instead of key

Before we merge this, we need to add the service account the permission for the workload identity, delete the existing key and then we can remove the secret from the repository.

I don't have enough permission to make this change in the GCP project, wondering if @dlorenc or @bobcallaway can do that.

codecov-commenter: # [Codecov](https://codecov.io/gh/sigstore/cosign/pull/2252?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) Report
> Merging [#2252](https://codecov.io/gh/sigstore/cosign/pull/2252?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (e0ffcb9) into [main](https://codecov.io/gh/sigstore/cosign/commit/f43839b84cad5fefd19c93b436b4eee324d38f99?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (f43839b) will **not change** coverage.
> The diff coverage is `n/a`.

```diff
@@           Coverage Diff           @@
##             main    #2252   +/-   ##
=======================================
  Coverage   28.40%   28.40%           
=======================================
  Files         131      131           
  Lines        7832     7832           
=======================================
  Hits         2225     2225           
  Misses       5309     5309           
  Partials      298      298           
```



Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore)

github-actions[bot]: This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.
cpanato: ping @bobcallaway @dlorenc need to get this in to fix the failing tests in the main branch

Patch:
diff --git a/cmd/cosign/cli/options/verify.go b/cmd/cosign/cli/options/verify.go
index 0a24e23c..e6f9277b 100644
--- a/cmd/cosign/cli/options/verify.go
+++ b/cmd/cosign/cli/options/verify.go
@@ -22,7 +22,6 @@ import (
 type CommonVerifyOptions struct {
 	Offline          bool // Force offline verification
 	TSACertChainPath string
-	TSAServerURL     string
 	SkipTlogVerify   bool
 }
 
@@ -30,9 +29,6 @@ func (o *CommonVerifyOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().BoolVar(&o.Offline, "offline", false,
 		"only allow offline verification")
 
-	cmd.Flags().StringVar(&o.TSAServerURL, "timestamp-server-url", "",
-		"url to a timestamp RFC3161 server, default none")
-
 	cmd.Flags().StringVar(&o.TSACertChainPath, "timestamp-cert-chain", "",
 		"path to certificate chain PEM file for the Timestamp Authority")
 
diff --git a/cmd/cosign/cli/policy_init.go b/cmd/cosign/cli/policy_init.go
index 1ba62d03..4cdf3589 100644
--- a/cmd/cosign/cli/policy_init.go
+++ b/cmd/cosign/cli/policy_init.go
@@ -261,7 +261,7 @@ func signPolicy() *cobra.Command {
 			}
 
 			// Upload to rekor
-			if sign.ShouldUploadToTlog(ctx, ko, ref, ko.SkipConfirmation, o.TlogUpload) {
+			if sign.ShouldUploadToTlog(ctx, ko, ref, ko.SkipConfirmation, o.TlogUpload, "") {
 				// TODO: Refactor with sign.go
 				rekorBytes := sv.Cert
 				rekorClient, err := rekor.NewClient(o.Rekor.URL)
diff --git a/cmd/cosign/cli/sign/sign.go b/cmd/cosign/cli/sign/sign.go
index 535511e5..9f30dc0d 100644
--- a/cmd/cosign/cli/sign/sign.go
+++ b/cmd/cosign/cli/sign/sign.go
@@ -69,7 +69,11 @@ const TagReferenceMessage string = `WARNING: Image reference %s uses a tag, not
     images by tag will be removed in a future release.
 `
 
-func ShouldUploadToTlog(ctx context.Context, ko options.KeyOpts, ref name.Reference, skipConfirmation, tlogUpload bool) bool {
+func ShouldUploadToTlog(ctx context.Context, ko options.KeyOpts, ref name.Reference, skipConfirmation, tlogUpload bool, tsaServerURL string) bool {
+	// Check if TSA signing is enabled and tlog upload is disabled
+	if !tlogUpload && tsaServerURL != "" {
+		fmt.Fprintln(os.Stderr, "\nWARNING: skipping transparency log upload")
+	}
 	// If we aren't using keyless signing and --tlog-upload=false, return
 	if !keylessSigning(ko) && !tlogUpload {
 		return false
@@ -243,7 +247,7 @@ func signDigest(ctx context.Context, digest name.Digest, payload []byte, ko opti
 
 		s = tsa.NewSigner(s, clientTSA)
 	}
-	if ShouldUploadToTlog(ctx, ko, digest, ko.SkipConfirmation, tlogUpload) {
+	if ShouldUploadToTlog(ctx, ko, digest, ko.SkipConfirmation, tlogUpload, ko.TSAServerURL) {
 		rClient, err := rekor.NewClient(ko.RekorURL)
 		if err != nil {
 			return err
diff --git a/cmd/cosign/cli/sign/sign_blob.go b/cmd/cosign/cli/sign/sign_blob.go
index aaf5d14b..1e5d7c51 100644
--- a/cmd/cosign/cli/sign/sign_blob.go
+++ b/cmd/cosign/cli/sign/sign_blob.go
@@ -65,7 +65,7 @@ func SignBlobCmd(ro *options.RootOptions, ko options.KeyOpts, regOpts options.Re
 
 	signedPayload := cosign.LocalSignedPayload{}
 
-	if ShouldUploadToTlog(ctx, ko, nil, ko.SkipConfirmation, tlogUpload) {
+	if ShouldUploadToTlog(ctx, ko, nil, ko.SkipConfirmation, tlogUpload, "") {
 		rekorBytes, err = sv.Bytes(ctx)
 		if err != nil {
 			return nil, err
diff --git a/cmd/cosign/cli/verify.go b/cmd/cosign/cli/verify.go
index 97fc8497..3ca3dd44 100644
--- a/cmd/cosign/cli/verify.go
+++ b/cmd/cosign/cli/verify.go
@@ -119,7 +119,6 @@ against the transparency log.`,
 				SignatureRef:                 o.SignatureRef,
 				LocalImage:                   o.LocalImage,
 				Offline:                      o.CommonVerifyOptions.Offline,
-				TSAServerURL:                 o.CommonVerifyOptions.TSAServerURL,
 				TSACertChainPath:             o.CommonVerifyOptions.TSACertChainPath,
 				SkipTlogVerify:               o.CommonVerifyOptions.SkipTlogVerify,
 			}
diff --git a/cmd/cosign/cli/verify/verify.go b/cmd/cosign/cli/verify/verify.go
index f23af023..694bc46f 100644
--- a/cmd/cosign/cli/verify/verify.go
+++ b/cmd/cosign/cli/verify/verify.go
@@ -43,7 +43,6 @@ import (
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/payload"
-	tsaclient "github.com/sigstore/timestamp-authority/pkg/client"
 )
 
 // VerifyCommand verifies a signature on a supplied container image
@@ -124,30 +123,24 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) {
 		co.ClaimVerifier = cosign.SimpleClaimVerifier
 	}
 
-	if c.TSAServerURL != "" {
-		co.TSAClient, err = tsaclient.GetTimestampClient(c.TSAServerURL)
+	if c.TSACertChainPath != "" {
+		_, err := os.Stat(c.TSACertChainPath)
 		if err != nil {
-			return fmt.Errorf("failed to create TSA client: %w", err)
+			return fmt.Errorf("unable to open timestamp certificate chain file: %w", err)
 		}
-		if c.TSACertChainPath != "" {
-			_, err := os.Stat(c.TSACertChainPath)
-			if err != nil {
-				return fmt.Errorf("unable to open timestamp certificate chain file: %w", err)
-			}
-			// TODO: Add support for TUF certificates.
-			pemBytes, err := os.ReadFile(filepath.Clean(c.TSACertChainPath))
-			if err != nil {
-				return fmt.Errorf("error reading certification chain path file: %w", err)
-			}
-			// TODO: Update this logic once https://github.com/sigstore/timestamp-authority/issues/121 gets merged.
-			// This relies on untrusted leaf certificate.
-			tsaCertPool := x509.NewCertPool()
-			ok := tsaCertPool.AppendCertsFromPEM(pemBytes)
-			if !ok {
-				return fmt.Errorf("error parsing response into Timestamp while appending certs from PEM")
-			}
-			co.TSACerts = tsaCertPool
+		// TODO: Add support for TUF certificates.
+		pemBytes, err := os.ReadFile(filepath.Clean(c.TSACertChainPath))
+		if err != nil {
+			return fmt.Errorf("error reading certification chain path file: %w", err)
+		}
+		// TODO: Update this logic once https://github.com/sigstore/timestamp-authority/issues/121 gets merged.
+		// This relies on untrusted leaf certificate.
+		tsaCertPool := x509.NewCertPool()
+		ok := tsaCertPool.AppendCertsFromPEM(pemBytes)
+		if !ok {
+			return fmt.Errorf("error parsing response into Timestamp while appending certs from PEM")
 		}
+		co.TSACerts = tsaCertPool
 	}
 
 	if keylessVerification(c.KeyRef, c.Sk) {
@@ -388,11 +381,11 @@ func PrintVerification(imgRef string, verified []oci.Signature, output string) {
 				}
 				ss.Optional["Bundle"] = bundle
 			}
-			if tsaBundle, err := sig.TSABundle(); err == nil && tsaBundle != nil {
+			if rfc3161Timestamp, err := sig.RFC3161Timestamp(); err == nil && rfc3161Timestamp != nil {
 				if ss.Optional == nil {
 					ss.Optional = make(map[string]interface{})
 				}
-				ss.Optional["TSABundle"] = tsaBundle
+				ss.Optional["RFC3161Timestamp"] = rfc3161Timestamp
 			}
 
 			outputKeys = append(outputKeys, ss)
diff --git a/cmd/cosign/cli/verify/verify_blob.go b/cmd/cosign/cli/verify/verify_blob.go
index 4284aeaf..954e7dcd 100644
--- a/cmd/cosign/cli/verify/verify_blob.go
+++ b/cmd/cosign/cli/verify/verify_blob.go
@@ -16,49 +16,30 @@
 package verify
 
 import (
-	"bytes"
 	"context"
 	"crypto"
-	"crypto/sha256"
 	"crypto/x509"
 	"encoding/base64"
-	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
-	"time"
 
-	"github.com/go-openapi/runtime"
 	ssldsse "github.com/secure-systems-lab/go-securesystemslib/dsse"
 	"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
 	"github.com/sigstore/cosign/cmd/cosign/cli/options"
 	"github.com/sigstore/cosign/cmd/cosign/cli/rekor"
 	"github.com/sigstore/cosign/pkg/blob"
 	"github.com/sigstore/cosign/pkg/cosign"
-	"github.com/sigstore/cosign/pkg/cosign/bundle"
 	"github.com/sigstore/cosign/pkg/cosign/pivkey"
 	"github.com/sigstore/cosign/pkg/cosign/pkcs11key"
+	"github.com/sigstore/cosign/pkg/oci/static"
 	sigs "github.com/sigstore/cosign/pkg/signature"
-	"github.com/sigstore/sigstore/pkg/tuf"
 
 	ctypes "github.com/sigstore/cosign/pkg/types"
-	"github.com/sigstore/rekor/pkg/generated/client"
-	"github.com/sigstore/rekor/pkg/generated/models"
-	"github.com/sigstore/rekor/pkg/pki"
-	"github.com/sigstore/rekor/pkg/types"
-	"github.com/sigstore/rekor/pkg/types/hashedrekord"
-	hashedrekord_v001 "github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1"
-	"github.com/sigstore/rekor/pkg/types/intoto"
-	intoto_v001 "github.com/sigstore/rekor/pkg/types/intoto/v0.0.1"
-	"github.com/sigstore/rekor/pkg/types/rekord"
-	rekord_v001 "github.com/sigstore/rekor/pkg/types/rekord/v0.0.1"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
-	"github.com/sigstore/sigstore/pkg/signature/dsse"
-	signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
 )
 
 func isb64(data []byte) bool {
@@ -88,14 +69,19 @@ type VerifyBlobCmd struct {
 // nolint
 func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
 	var cert *x509.Certificate
-	var bundle *bundle.RekorBundle
+	opts := make([]static.Option, 0)
 
 	// Require a certificate/key OR a local bundle file that has the cert.
-	if options.NOf(c.KeyRef, c.Sk) > 1 {
+	if options.NOf(c.KeyRef, c.CertRef, c.Sk, c.BundlePath) == 0 {
+		return fmt.Errorf("please provide a cert to verify against via --certificate or a bundle via --bundle")
+	}
+
+	// Key, sk, and cert are mutually exclusive.
+	if options.NOf(c.KeyRef, c.Sk, c.CertRef) > 1 {
 		return &options.KeyParseError{}
 	}
 
-	sig, err := signatures(c.SigRef, c.BundlePath)
+	sig, err := base64signature(c.SigRef, c.BundlePath)
 	if err != nil {
 		return err
 	}
@@ -125,13 +111,16 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
 			}
 			co.RekorClient = rekorClient
 		}
-		co.RootCerts, err = fulcio.GetRoots()
-		if err != nil {
-			return fmt.Errorf("getting Fulcio roots: %w", err)
-		}
-		co.IntermediateCerts, err = fulcio.GetIntermediates()
-		if err != nil {
-			return fmt.Errorf("getting Fulcio intermediates: %w", err)
+		// Use default TUF roots if a cert chain is not provided.
+		if c.CertChain == "" {
+			co.RootCerts, err = fulcio.GetRoots()
+			if err != nil {
+				return fmt.Errorf("getting Fulcio roots: %w", err)
+			}
+			co.IntermediateCerts, err = fulcio.GetIntermediates()
+			if err != nil {
+				return fmt.Errorf("getting Fulcio intermediates: %w", err)
+			}
 		}
 	}
 
@@ -161,118 +150,77 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
 		if err != nil {
 			return err
 		}
-		if c.CertChain == "" {
-			co.RootCerts, err = fulcio.GetRoots()
-			if err != nil {
-				return fmt.Errorf("getting Fulcio roots: %w", err)
-			}
-
-			co.IntermediateCerts, err = fulcio.GetIntermediates()
-			if err != nil {
-				return fmt.Errorf("getting Fulcio intermediates: %w", err)
-			}
-			co.SigVerifier, err = cosign.ValidateAndUnpackCert(cert, co)
-			if err != nil {
-				return fmt.Errorf("validating certRef: %w", err)
-			}
-		} else {
-			// Verify certificate with chain
-			chain, err := loadCertChainFromFileOrURL(c.CertChain)
-			if err != nil {
-				return err
-			}
-			co.SigVerifier, err = cosign.ValidateAndUnpackCertWithChain(cert, chain, co)
-			if err != nil {
-				return fmt.Errorf("verifying certRef with certChain: %w", err)
-			}
-		}
-		if c.SCTRef != "" {
-			sct, err := os.ReadFile(filepath.Clean(c.SCTRef))
-			if err != nil {
-				return fmt.Errorf("reading sct from file: %w", err)
-			}
-			co.SCT = sct
-		}
-	case c.BundlePath != "":
+	}
+	if c.BundlePath != "" {
 		b, err := cosign.FetchLocalSignedPayloadFromPath(c.BundlePath)
 		if err != nil {
 			return err
 		}
-		if b.Cert == "" {
+		// A certificate is required in the bundle unless we specified with
+		//  --key, --sk, or --certificate.
+		if b.Cert == "" && co.SigVerifier == nil && cert == nil {
 			return fmt.Errorf("bundle does not contain cert for verification, please provide public key")
 		}
-		// b.Cert can either be a certificate or public key
-		certBytes := []byte(b.Cert)
-		if isb64(certBytes) {
-			certBytes, _ = base64.StdEncoding.DecodeString(b.Cert)
-		}
-		cert, err = loadCertFromPEM(certBytes)
-		if err != nil {
-			// check if cert is actually a public key
-			co.SigVerifier, err = sigs.LoadPublicKeyRaw(certBytes, crypto.SHA256)
-		} else {
-			if c.CertChain == "" {
-				co.RootCerts, err = fulcio.GetRoots()
-				if err != nil {
-					return fmt.Errorf("getting Fulcio roots: %w", err)
-				}
-				co.IntermediateCerts, err = fulcio.GetIntermediates()
-				if err != nil {
-					return fmt.Errorf("getting Fulcio intermediates: %w", err)
-				}
-				co.SigVerifier, err = cosign.ValidateAndUnpackCert(cert, co)
-				if err != nil {
-					return fmt.Errorf("verifying certificate from bundle: %w", err)
-				}
-			} else {
-				// Verify certificate with chain
-				chain, err := loadCertChainFromFileOrURL(c.CertChain)
-				if err != nil {
-					return err
-				}
-				co.SigVerifier, err = cosign.ValidateAndUnpackCertWithChain(cert, chain, co)
+		// We have to condition on this because sign-blob may not output the signing
+		// key to the bundle when there is no tlog upload.
+		if b.Cert != "" {
+			// b.Cert can either be a certificate or public key
+			certBytes := []byte(b.Cert)
+			if isb64(certBytes) {
+				certBytes, _ = base64.StdEncoding.DecodeString(b.Cert)
+			}
+			cert, err = loadCertFromPEM(certBytes)
+			if err != nil {
+				// check if cert is actually a public key
+				co.SigVerifier, err = sigs.LoadPublicKeyRaw(certBytes, crypto.SHA256)
 				if err != nil {
-					return fmt.Errorf("verifying certificate from bundle with chain: %w", err)
+					return fmt.Errorf("loading verifier from bundle: %w", err)
 				}
 			}
 		}
+		opts = append(opts, static.WithBundle(b.Bundle))
+	}
+	// Set an SCT if provided via the CLI.
+	if c.SCTRef != "" {
+		sct, err := os.ReadFile(filepath.Clean(c.SCTRef))
 		if err != nil {
-			return fmt.Errorf("loading verifier from bundle: %w", err)
+			return fmt.Errorf("reading sct from file: %w", err)
 		}
-		bundle = b.Bundle
-	default:
-		return fmt.Errorf("please provide a cert to verify against via --certificate or a bundle via --bundle")
+		co.SCT = sct
 	}
-
-	// Performs all blob verification.
-	if err := verifyBlob(ctx, co, blobBytes, sig, cert, bundle); err != nil {
-		return err
+	// Set a cert chain if provided.
+	var chainPEM []byte
+	if c.CertChain != "" {
+		chain, err := loadCertChainFromFileOrURL(c.CertChain)
+		if err != nil {
+			return err
+		}
+		if chain == nil {
+			return errors.New("expected certificate chain in --certificate-chain")
+		}
+		// Set the last one in the co.RootCerts. This is trusted, as its passed in
+		// via the CLI.
+		if co.RootCerts == nil {
+			co.RootCerts = x509.NewCertPool()
+		}
+		co.RootCerts.AddCert(chain[len(chain)-1])
+		// Use the whole as the cert chain in the signature object.
+		// The last one is omitted because it is considered the "root".
+		chainPEM, err = cryptoutils.MarshalCertificatesToPEM(chain)
+		if err != nil {
+			return err
+		}
 	}
 
-	fmt.Fprintln(os.Stderr, "Verified OK")
-	return nil
-}
-
-/* Verify Blob main entry point. This will perform the following:
-   1. Verifies the signature on the blob using the provided verifier.
-   2. Checks for transparency log entry presence:
-        a. Verifies the Rekor entry in the bundle, if provided. This works offline OR
-        b. If we don't have a Rekor entry retrieved via cert, do an online lookup (assuming
-           we are in experimental mode).
-   3. If a certificate is provided, check it's expiration.
-*/
-// TODO: Make a version of this public. This could be VerifyBlobCmd, but we need to
-// clean up the args into CheckOpts or use KeyOpts here to resolve different KeyOpts.
-func verifyBlob(ctx context.Context, co *cosign.CheckOpts,
-	blobBytes []byte, sig string, cert *x509.Certificate,
-	bundle *bundle.RekorBundle) error {
+	// Gather the cert for the signature and add the cert along with the
+	// cert chain into the signature object.
+	var certPEM []byte
 	if cert != nil {
-		// This would have already be done in the main entrypoint, but do this for robustness.
-		var err error
-		co.SigVerifier, err = cosign.ValidateAndUnpackCert(cert, co)
+		certPEM, err = cryptoutils.MarshalCertificateToPEM(cert)
 		if err != nil {
-			return fmt.Errorf("validating cert: %w", err)
+			return err
 		}
+		opts = append(opts, static.WithCertChain(certPEM, chainPEM))
 	}
 
 	// Use the DSSE verifier if the payload is a DSSE with the In-Toto format.
@@ -280,133 +228,33 @@ func verifyBlob(ctx context.Context, co *cosign.CheckOpts,
 	// the envelope. Either have the verifier validate that only one signature exists,
 	// or use a multi-signature verifier.
 	if isIntotoDSSE(blobBytes) {
-		co.SigVerifier = dsse.WrapVerifier(co.SigVerifier)
-	}
-
-	// 1. Verify the signature.
-	if err := co.SigVerifier.VerifySignature(strings.NewReader(sig), bytes.NewReader(blobBytes)); err != nil {
-		return err
-	}
-
-	// This is the signature creation time. Without a transparency log entry timestamp,
-	// we can only use the current time as a bound.
-	var validityTime time.Time
-	// 2. Checks for transparency log entry presence:
-	switch {
-	// a. We have a local bundle.
-	case bundle != nil:
-		var svBytes []byte
-		var err error
-		if cert != nil {
-			svBytes, err = cryptoutils.MarshalCertificateToPEM(cert)
-			if err != nil {
-				return fmt.Errorf("marshalling cert: %w", err)
-			}
-		} else {
-			svBytes, err = sigs.PublicKeyPem(co.SigVerifier, signatureoptions.WithContext(ctx))
-			if err != nil {
-				return fmt.Errorf("marshalling pubkey: %w", err)
-			}
-		}
-		bundle, err := verifyRekorBundle(ctx, bundle, blobBytes, sig, svBytes)
+		// co.SigVerifier = dsse.WrapVerifier(co.SigVerifier)
+		signature, err := static.NewAttestation(blobBytes, opts...)
 		if err != nil {
-			// Return when the provided bundle fails verification. (Do not fallback).
 			return err
 		}
-		validityTime = time.Unix(bundle.IntegratedTime, 0)
-		fmt.Fprintf(os.Stderr, "tlog entry verified offline\n")
-	// b. We can make an online lookup to the transparency log since we don't have an entry.
-	case co.RekorClient != nil:
-		var tlogFindErr error
-		var e *models.LogEntryAnon
-		if cert == nil {
-			pub, err := co.SigVerifier.PublicKey(co.PKOpts...)
-			if err != nil {
-				return err
-			}
-			e, tlogFindErr = tlogFindPublicKey(ctx, co.RekorClient, blobBytes, sig, pub)
-		} else {
-			e, tlogFindErr = tlogFindCertificate(ctx, co.RekorClient, blobBytes, sig, cert)
-		}
-		if tlogFindErr != nil {
-			// TODO: Think about whether we should break here.
-			// This is COSIGN_EXPERIMENTAL mode, but in the case where someone
-			// provided a public key or still-valid cert,
-			/// they don't need TLOG lookup for the timestamp.
-			fmt.Fprintf(os.Stderr, "could not find entry in tlog: %s", tlogFindErr)
-			return tlogFindErr
-		}
-		if err := cosign.VerifyTLogEntry(ctx, nil, e); err != nil {
+		// We have no artifact the attestation is tied to, so we can't do any claim
+		// verification.
+		// TODO: Add an option to support this to populate the v1.Hash for a claim.
+		if _, err = cosign.VerifyBlobAttestation(ctx, signature, co); err != nil {
 			return err
 		}
-
-		uuid, err := cosign.ComputeLeafHash(e)
+	} else {
+		signature, err := static.NewSignature(blobBytes, sig, opts...)
 		if err != nil {
 			return err
 		}
-
-		validityTime = time.Unix(*e.IntegratedTime, 0)
-		fmt.Fprintf(os.Stderr, "tlog entry verified with uuid: %s index: %d\n", hex.EncodeToString(uuid), *e.LogIndex)
-	// If we do not have access to a bundle, a Rekor entry, or the access to lookup,
-	// then we can only use the current time as the signature creation time to verify
-	// the signature was created when the certificate was valid.
-	default:
-		validityTime = time.Now()
-	}
-
-	// 3. If a certificate is provided, check it's expiration.
-	if cert == nil {
-		return nil
-	}
-
-	return cosign.CheckExpiry(cert, validityTime)
-}
-
-func tlogFindPublicKey(ctx context.Context, rekorClient *client.Rekor,
-	blobBytes []byte, sig string, pub crypto.PublicKey) (*models.LogEntryAnon, error) {
-	pemBytes, err := cryptoutils.MarshalPublicKeyToPEM(pub)
-	if err != nil {
-		return nil, err
-	}
-	return tlogFindEntry(ctx, rekorClient, blobBytes, sig, pemBytes)
-}
-
-func tlogFindCertificate(ctx context.Context, rekorClient *client.Rekor,
-	blobBytes []byte, sig string, cert *x509.Certificate) (*models.LogEntryAnon, error) {
-	pemBytes, err := cryptoutils.MarshalCertificateToPEM(cert)
-	if err != nil {
-		return nil, err
-	}
-	return tlogFindEntry(ctx, rekorClient, blobBytes, sig, pemBytes)
-}
-
-func tlogFindEntry(ctx context.Context, client *client.Rekor,
-	blobBytes []byte, sig string, pem []byte) (*models.LogEntryAnon, error) {
-	b64sig := base64.StdEncoding.EncodeToString([]byte(sig))
-	tlogEntries, err := cosign.FindTlogEntry(ctx, client, b64sig, blobBytes, pem)
-	if err != nil {
-		return nil, err
-	}
-	if len(tlogEntries) == 0 {
-		return nil, fmt.Errorf("no valid tlog entries found with proposed entry")
-	}
-	// Always return the earliest integrated entry. That
-	// always suffices for verification of signature time.
-	var earliestLogEntry models.LogEntryAnon
-	var earliestLogEntryTime *time.Time
-	// We'll always return a tlog entry because there's at least one entry in the log.
-	for _, entry := range tlogEntries {
-		entryTime := time.Unix(*entry.IntegratedTime, 0)
-		if earliestLogEntryTime == nil || entryTime.Before(*earliestLogEntryTime) {
-			earliestLogEntryTime = &entryTime
-			earliestLogEntry = entry
+		if _, err = cosign.VerifyBlobSignature(ctx, signature, co); err != nil {
+			return err
 		}
 	}
-	return &earliestLogEntry, nil
+
+	fmt.Fprintln(os.Stderr, "Verified OK")
+	return nil
 }
 
-// signatures returns the raw signature
-func signatures(sigRef string, bundlePath string) (string, error) {
+// base64signature returns the base64 encoded signature
+func base64signature(sigRef string, bundlePath string) (string, error) {
 	var targetSig []byte
 	var err error
 	switch {
@@ -429,15 +277,10 @@ func signatures(sigRef string, bundlePath string) (string, error) {
 		return "", fmt.Errorf("missing flag '--signature'")
 	}
 
-	var sig, b64sig string
 	if isb64(targetSig) {
-		b64sig = string(targetSig)
-		sigBytes, _ := base64.StdEncoding.DecodeString(b64sig)
-		sig = string(sigBytes)
-	} else {
-		sig = string(targetSig)
+		return string(targetSig), nil
 	}
-	return sig, nil
+	return base64.StdEncoding.EncodeToString(targetSig), nil
 }
 
 func payloadBytes(blobRef string) ([]byte, error) {
@@ -454,160 +297,6 @@ func payloadBytes(blobRef string) ([]byte, error) {
 	return blobBytes, nil
 }
 
-func verifyRekorBundle(ctx context.Context, bundle *bundle.RekorBundle,
-	blobBytes []byte, sig string, pubKeyBytes []byte) (*bundle.RekorPayload, error) {
-	if err := verifyBundleMatchesData(ctx, bundle, blobBytes, pubKeyBytes, []byte(sig)); err != nil {
-		return nil, err
-	}
-
-	publicKeys, err := cosign.GetRekorPubs(ctx, nil)
-	if err != nil {
-		return nil, fmt.Errorf("retrieving rekor public key: %w", err)
-	}
-
-	pubKey, ok := publicKeys[bundle.Payload.LogID]
-	if !ok {
-		return nil, errors.New("rekor log public key not found for payload")
-	}
-	err = cosign.VerifySET(bundle.Payload, bundle.SignedEntryTimestamp, pubKey.PubKey)
-	if err != nil {
-		return nil, err
-	}
-	if pubKey.Status != tuf.Active {
-		fmt.Fprintf(os.Stderr, "**Info** Successfully verified Rekor entry using an expired verification key\n")
-	}
-
-	return &bundle.Payload, nil
-}
-
-func verifyBundleMatchesData(ctx context.Context, bundle *bundle.RekorBundle, blobBytes, certBytes, sigBytes []byte) error {
-	eimpl, kind, apiVersion, err := unmarshalEntryImpl(bundle.Payload.Body.(string))
-	if err != nil {
-		return err
-	}
-
-	targetImpl, err := reconstructCanonicalizedEntry(ctx, kind, apiVersion, blobBytes, certBytes, sigBytes)
-	if err != nil {
-		return fmt.Errorf("recontructing rekorEntry for bundle comparison: %w", err)
-	}
-
-	switch e := eimpl.(type) {
-	case *rekord_v001.V001Entry:
-		t := targetImpl.(*rekord_v001.V001Entry)
-		data, err := e.RekordObj.Data.Content.MarshalText()
-		if err != nil {
-			return fmt.Errorf("invalid rekord data: %w", err)
-		}
-		tData, err := t.RekordObj.Data.Content.MarshalText()
-		if err != nil {
-			return fmt.Errorf("invalid rekord data: %w", err)
-		}
-		if !bytes.Equal(data, tData) {
-			return fmt.Errorf("rekord data does not match blob")
-		}
-		if err := compareBase64Strings(e.RekordObj.Signature.Content.String(),
-			t.RekordObj.Signature.Content.String()); err != nil {
-			return fmt.Errorf("rekord signature does not match bundle %w", err)
-		}
-		if err := compareBase64Strings(e.RekordObj.Signature.PublicKey.Content.String(),
-			t.RekordObj.Signature.PublicKey.Content.String()); err != nil {
-			return fmt.Errorf("rekord public key does not match bundle")
-		}
-	case *hashedrekord_v001.V001Entry:
-		t := targetImpl.(*hashedrekord_v001.V001Entry)
-		if *e.HashedRekordObj.Data.Hash.Value != *t.HashedRekordObj.Data.Hash.Value {
-			return fmt.Errorf("hashedRekord data does not match blob")
-		}
-		if err := compareBase64Strings(e.HashedRekordObj.Signature.Content.String(),
-			t.HashedRekordObj.Signature.Content.String()); err != nil {
-			return fmt.Errorf("hashedRekord signature does not match bundle %w", err)
-		}
-		if err := compareBase64Strings(e.HashedRekordObj.Signature.PublicKey.Content.String(),
-			t.HashedRekordObj.Signature.PublicKey.Content.String()); err != nil {
-			return fmt.Errorf("hashedRekord public key does not match bundle")
-		}
-	case *intoto_v001.V001Entry:
-		t := targetImpl.(*intoto_v001.V001Entry)
-		if *e.IntotoObj.Content.Hash.Value != *t.IntotoObj.Content.Hash.Value {
-			return fmt.Errorf("intoto content hash does not match attestation")
-		}
-		if *e.IntotoObj.Content.PayloadHash.Value != *t.IntotoObj.Content.PayloadHash.Value {
-			return fmt.Errorf("intoto payload hash does not match attestation")
-		}
-		if err := compareBase64Strings(e.IntotoObj.PublicKey.String(),
-			t.IntotoObj.PublicKey.String()); err != nil {
-			return fmt.Errorf("intoto public key does not match bundle")
-		}
-	default:
-		return errors.New("unexpected tlog entry type")
-	}
-	return nil
-}
-
-func reconstructCanonicalizedEntry(ctx context.Context, kind, apiVersion string, blobBytes, certBytes, sigBytes []byte) (types.EntryImpl, error) {
-	props := types.ArtifactProperties{
-		PublicKeyBytes: [][]byte{certBytes},
-		PKIFormat:      string(pki.X509),
-	}
-	switch kind {
-	case rekord.KIND:
-		props.ArtifactBytes = blobBytes
-		props.SignatureBytes = sigBytes
-	case hashedrekord.KIND:
-		blobHash := sha256.Sum256(blobBytes)
-		props.ArtifactHash = strings.ToLower(hex.EncodeToString(blobHash[:]))
-		props.SignatureBytes = sigBytes
-	case intoto.KIND:
-		props.ArtifactBytes = blobBytes
-	default:
-		return nil, fmt.Errorf("unexpected entry kind: %s", kind)
-	}
-	proposedEntry, err := types.NewProposedEntry(ctx, kind, apiVersion, props)
-	if err != nil {
-		return nil, err
-	}
-
-	eimpl, err := types.CreateVersionedEntry(proposedEntry)
-	if err != nil {
-		return nil, err
-	}
-
-	can, err := types.CanonicalizeEntry(ctx, eimpl)
-	if err != nil {
-		return nil, err
-	}
-	proposedEntryCan, err := models.UnmarshalProposedEntry(bytes.NewReader(can), runtime.JSONConsumer())
-	if err != nil {
-		return nil, err
-	}
-
-	eimpl, err = types.UnmarshalEntry(proposedEntryCan)
-	if err != nil {
-		return nil, err
-	}
-
-	return eimpl, nil
-}
-
-// unmarshalEntryImpl decodes the base64-encoded entry to a specific entry type (types.EntryImpl).
-func unmarshalEntryImpl(e string) (types.EntryImpl, string, string, error) {
-	b, err := base64.StdEncoding.DecodeString(e)
-	if err != nil {
-		return nil, "", "", err
-	}
-
-	pe, err := models.UnmarshalProposedEntry(bytes.NewReader(b), runtime.JSONConsumer())
-	if err != nil {
-		return nil, "", "", err
-	}
-
-	entry, err := types.UnmarshalEntry(pe)
-	if err != nil {
-		return nil, "", "", err
-	}
-	return entry, pe.Kind(), entry.APIVersion(), nil
-}
-
 // isIntotoDSSE checks whether a payload is a Dead Simple Signing Envelope with the In-Toto format.
 func isIntotoDSSE(blobBytes []byte) bool {
 	DSSEenvelope := ssldsse.Envelope{}
@@ -620,19 +309,3 @@ func isIntotoDSSE(blobBytes []byte) bool {
 
 	return true
 }
-
-// TODO: Use this function to compare bundle signatures in OCI.
-func compareBase64Strings(got string, expected string) error {
-	decodeFirst, err := base64.StdEncoding.DecodeString(got)
-	if err != nil {
-		return fmt.Errorf("decoding base64 string %s", got)
-	}
-	decodeSecond, err := base64.StdEncoding.DecodeString(expected)
-	if err != nil {
-		return fmt.Errorf("decoding base64 string %s", expected)
-	}
-	if !bytes.Equal(decodeFirst, decodeSecond) {
-		return fmt.Errorf("comparing base64 strings, expected %s, got %s", expected, got)
-	}
-	return nil
-}
diff --git a/doc/cosign_dockerfile_verify.md b/doc/cosign_dockerfile_verify.md
index 8d1974cc..14a47c5b 100644
--- a/doc/cosign_dockerfile_verify.md
+++ b/doc/cosign_dockerfile_verify.md
@@ -84,7 +84,6 @@ cosign dockerfile verify [flags]
       --sk                                                                                       whether to use a hardware security key
       --slot string                                                                              security key slot to use for generated key (default: signature) (authentication|signature|card-authentication|key-management)
       --timestamp-cert-chain string                                                              path to certificate chain PEM file for the Timestamp Authority
-      --timestamp-server-url string                                                              url to a timestamp RFC3161 server, default none
 ```
 
 ### Options inherited from parent commands
diff --git a/doc/cosign_manifest_verify.md b/doc/cosign_manifest_verify.md
index 0c051a3c..dc1fe37c 100644
--- a/doc/cosign_manifest_verify.md
+++ b/doc/cosign_manifest_verify.md
@@ -78,7 +78,6 @@ cosign manifest verify [flags]
       --sk                                                                                       whether to use a hardware security key
       --slot string                                                                              security key slot to use for generated key (default: signature) (authentication|signature|card-authentication|key-management)
       --timestamp-cert-chain string                                                              path to certificate chain PEM file for the Timestamp Authority
-      --timestamp-server-url string                                                              url to a timestamp RFC3161 server, default none
 ```
 
 ### Options inherited from parent commands
diff --git a/doc/cosign_verify-blob.md b/doc/cosign_verify-blob.md
index 8915299f..32cc60e2 100644
--- a/doc/cosign_verify-blob.md
+++ b/doc/cosign_verify-blob.md
@@ -84,7 +84,6 @@ cosign verify-blob [flags]
       --sk                                                                                       whether to use a hardware security key
       --slot string                                                                              security key slot to use for generated key (default: signature) (authentication|signature|card-authentication|key-management)
       --timestamp-cert-chain string                                                              path to certificate chain PEM file for the Timestamp Authority
-      --timestamp-server-url string                                                              url to a timestamp RFC3161 server, default none
 ```
 
 ### Options inherited from parent commands
diff --git a/doc/cosign_verify.md b/doc/cosign_verify.md
index 4a87a16a..ae632635 100644
--- a/doc/cosign_verify.md
+++ b/doc/cosign_verify.md
@@ -94,7 +94,6 @@ cosign verify [flags]
       --sk                                                                                       whether to use a hardware security key
       --slot string                                                                              security key slot to use for generated key (default: signature) (authentication|signature|card-authentication|key-management)
       --timestamp-cert-chain string                                                              path to certificate chain PEM file for the Timestamp Authority
-      --timestamp-server-url string                                                              url to a timestamp RFC3161 server, default none
 ```
 
 ### Options inherited from parent commands
diff --git a/go.mod b/go.mod
index b6330bf5..f79c1ceb 100644
--- a/go.mod
+++ b/go.mod
@@ -38,7 +38,7 @@ require (
 	github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4
 	github.com/transparency-dev/merkle v0.0.1
 	github.com/withfig/autocomplete-tools/integrations/cobra v1.2.1
-	github.com/xanzy/go-gitlab v0.74.0
+	github.com/xanzy/go-gitlab v0.76.0
 	golang.org/x/crypto v0.3.0
 	golang.org/x/oauth2 v0.1.0
 	golang.org/x/sync v0.1.0
diff --git a/go.sum b/go.sum
index 1d288173..8bc988a8 100644
--- a/go.sum
+++ b/go.sum
@@ -1028,8 +1028,8 @@ github.com/vmihailenco/msgpack/v5 v5.3.5 h1:5gO0H1iULLWGhs2H5tbAHIZTV8/cYafcFOr9
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/withfig/autocomplete-tools/integrations/cobra v1.2.1 h1:+dBg5k7nuTE38VVdoroRsT0Z88fmvdYrI2EjzJst35I=
 github.com/withfig/autocomplete-tools/integrations/cobra v1.2.1/go.mod h1:nmuySobZb4kFgFy6BptpXp/BBw+xFSyvVPP6auoJB4k=
-github.com/xanzy/go-gitlab v0.74.0 h1:Ha1cokbjn0PXy6B19t3W324dwM4AOT52fuHr7nERPrc=
-github.com/xanzy/go-gitlab v0.74.0/go.mod h1:d/a0vswScO7Agg1CZNz15Ic6SSvBG9vfw8egL99t4kA=
+github.com/xanzy/go-gitlab v0.76.0 h1:mkmuB27RDVZY/iXR61pEUfIqJ15Iivfu1kc3KZtBICI=
+github.com/xanzy/go-gitlab v0.76.0/go.mod h1:d/a0vswScO7Agg1CZNz15Ic6SSvBG9vfw8egL99t4kA=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
 github.com/xdg-go/scram v1.1.1/go.mod h1:RaEWvsqvNKKvBPvcKeFjrG2cJqOkHTiyTpzz23ni57g=
diff --git a/internal/pkg/cosign/tsa/signer.go b/internal/pkg/cosign/tsa/signer.go
index 7d4f3a2e..a858fcd6 100644
--- a/internal/pkg/cosign/tsa/signer.go
+++ b/internal/pkg/cosign/tsa/signer.go
@@ -94,9 +94,9 @@ func (rs *signerWrapper) Sign(ctx context.Context, payload io.Reader) (oci.Signa
 	if err != nil {
 		return nil, nil, err
 	}
-	bundle := bundle.TimestampToTSABundle(responseBytes)
+	bundle := bundle.TimestampToRFC3161Timestamp(responseBytes)
 
-	newSig, err := mutate.Signature(sig, mutate.WithTSABundle(bundle))
+	newSig, err := mutate.Signature(sig, mutate.WithRFC3161Timestamp(bundle))
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/pkg/cosign/bundle/tsa.go b/pkg/cosign/bundle/tsa.go
index b2ba3937..e11864b7 100644
--- a/pkg/cosign/bundle/tsa.go
+++ b/pkg/cosign/bundle/tsa.go
@@ -14,18 +14,18 @@
 
 package bundle
 
-// TSABundle holds metadata about timestamp RFC3161 verification data.
-type TSABundle struct {
+// RFC3161Timestamp holds metadata about timestamp RFC3161 verification data.
+type RFC3161Timestamp struct {
 	// SignedRFC3161Timestamp contains a RFC3161 signed timestamp provided by a time-stamping server.
 	// Clients MUST verify the hashed message in the message imprint
 	// against the signature in the bundle. This is encoded as base64.
 	SignedRFC3161Timestamp []byte
 }
 
-// TimestampToTSABundle receives a base64 encoded RFC3161 timestamp.
-func TimestampToTSABundle(timestampRFC3161 []byte) *TSABundle {
+// TimestampToRFC3161Timestamp receives a base64 encoded RFC3161 timestamp.
+func TimestampToRFC3161Timestamp(timestampRFC3161 []byte) *RFC3161Timestamp {
 	if timestampRFC3161 != nil {
-		return &TSABundle{
+		return &RFC3161Timestamp{
 			SignedRFC3161Timestamp: timestampRFC3161,
 		}
 	}
diff --git a/pkg/cosign/fetch.go b/pkg/cosign/fetch.go
index 2f510d11..70ffb2f3 100644
--- a/pkg/cosign/fetch.go
+++ b/pkg/cosign/fetch.go
@@ -30,12 +30,12 @@ import (
 )
 
 type SignedPayload struct {
-	Base64Signature string
-	Payload         []byte
-	Cert            *x509.Certificate
-	Chain           []*x509.Certificate
-	Bundle          *bundle.RekorBundle
-	TSABundle       *bundle.TSABundle
+	Base64Signature  string
+	Payload          []byte
+	Cert             *x509.Certificate
+	Chain            []*x509.Certificate
+	Bundle           *bundle.RekorBundle
+	RFC3161Timestamp *bundle.RFC3161Timestamp
 }
 
 type LocalSignedPayload struct {
@@ -103,7 +103,7 @@ func FetchSignaturesForReference(ctx context.Context, ref name.Reference, opts .
 				return err
 			}
 
-			signatures[i].TSABundle, err = sig.TSABundle()
+			signatures[i].RFC3161Timestamp, err = sig.RFC3161Timestamp()
 			if err != nil {
 				return err
 			}
diff --git a/pkg/cosign/keys.go b/pkg/cosign/keys.go
index f224ab92..f40c16e7 100644
--- a/pkg/cosign/keys.go
+++ b/pkg/cosign/keys.go
@@ -44,9 +44,9 @@ const (
 	// PEM-encoded ECDSA private key
 	ECPrivateKeyPemType = "EC PRIVATE KEY"
 	// PEM-encoded PKCS #8 RSA, ECDSA or ED25519 private key
-	PrivateKeyPemType = "PRIVATE KEY"
-	BundleKey         = static.BundleAnnotationKey
-	TSABundleKey      = static.TSABundleAnnotationKey
+	PrivateKeyPemType   = "PRIVATE KEY"
+	BundleKey           = static.BundleAnnotationKey
+	RFC3161TimestampKey = static.RFC3161TimestampAnnotationKey
 )
 
 // PassFunc is the function to be called to retrieve the signer password. If
diff --git a/pkg/cosign/verify.go b/pkg/cosign/verify.go
index 1a6f02cd..bb237bc4 100644
--- a/pkg/cosign/verify.go
+++ b/pkg/cosign/verify.go
@@ -25,6 +25,7 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
+	"encoding/pem"
 	"errors"
 	"fmt"
 	"os"
@@ -56,7 +57,6 @@ import (
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
 	"github.com/sigstore/sigstore/pkg/signature/options"
 	sigPayload "github.com/sigstore/sigstore/pkg/signature/payload"
-	tsaclient "github.com/sigstore/timestamp-authority/pkg/generated/client"
 	tsaverification "github.com/sigstore/timestamp-authority/pkg/verification"
 )
 
@@ -128,9 +128,6 @@ type CheckOpts struct {
 	// Force offline verification of the signature
 	Offline bool
 
-	// TSAClient, if set, is used to verify signatures using a RFC3161 time-stamping server.
-	TSAClient *tsaclient.TimestampAuthority
-
 	// TSACerts are the intermediate CA certs used to verify a time-stamping data.
 	TSACerts *x509.CertPool
 
@@ -448,33 +445,8 @@ func ValidateAndUnpackCertWithChain(cert *x509.Certificate, chain []*x509.Certif
 	return ValidateAndUnpackCert(cert, co)
 }
 
-func tlogValidatePublicKey(ctx context.Context, rekorClient *client.Rekor, pub crypto.PublicKey, sig oci.Signature) error {
-	pemBytes, err := cryptoutils.MarshalPublicKeyToPEM(pub)
-	if err != nil {
-		return err
-	}
-	_, err = tlogValidateEntry(ctx, rekorClient, sig, pemBytes)
-	return err
-}
-
-func tlogValidateCertificate(ctx context.Context, rekorClient *client.Rekor, sig oci.Signature) error {
-	cert, err := sig.Cert()
-	if err != nil {
-		return err
-	}
-	pemBytes, err := cryptoutils.MarshalCertificateToPEM(cert)
-	if err != nil {
-		return err
-	}
-	e, err := tlogValidateEntry(ctx, rekorClient, sig, pemBytes)
-	if err != nil {
-		return err
-	}
-	// if we have a cert, we should check expiry
-	return CheckExpiry(cert, time.Unix(*e.IntegratedTime, 0))
-}
-
-func tlogValidateEntry(ctx context.Context, client *client.Rekor, sig oci.Signature, pem []byte) (*models.LogEntryAnon, error) {
+func tlogValidateEntry(ctx context.Context, client *client.Rekor, sig oci.Signature, pem []byte) (
+	*models.LogEntryAnon, error) {
 	b64sig, err := sig.Base64Signature()
 	if err != nil {
 		return nil, err
@@ -638,9 +610,13 @@ func verifySignatures(ctx context.Context, sigs oci.Signatures, h v1.Hash, co *C
 	return checkedSignatures, bundleVerified, nil
 }
 
-// verifyInternal holds the main verification flow for blobs and attestations.
-// It verifies the certificate chain, the signature, claims, a bundle or the online
-// Rekor client.
+// verifyInternal holds the main verification flow for signatures and attestations.
+//  1. Verifies the signature using the provided verifier.
+//  2. Checks for transparency log entry presence:
+//     a. Verifies the Rekor entry in the bundle, if provided. This works offline OR
+//     b. If we don't have a Rekor entry retrieved via cert, do an online lookup (assuming
+//     we are in experimental mode).
+//  3. If a certificate is provided, check it's expiration using the transparency log timestamp.
 func verifyInternal(ctx context.Context, sig oci.Signature, h v1.Hash,
 	verifyFn signatureVerificationFn, co *CheckOpts) (
 	bundleVerified bool, err error) {
@@ -659,16 +635,18 @@ func verifyInternal(ctx context.Context, sig oci.Signature, h v1.Hash,
 		if err != nil {
 			return bundleVerified, err
 		}
-		// If the chain annotation is not present or there is only a root
-		if chain == nil || len(chain) <= 1 {
-			co.IntermediateCerts = nil
-		} else if co.IntermediateCerts == nil {
-			// If the intermediate certs have not been loaded in by TUF
-			pool := x509.NewCertPool()
-			for _, cert := range chain[:len(chain)-1] {
-				pool.AddCert(cert)
+		// If there is no chain annotation present, we preserve the pools set in the CheckOpts.
+		if len(chain) > 0 {
+			if len(chain) == 1 {
+				co.IntermediateCerts = nil
+			} else if co.IntermediateCerts == nil {
+				// If the intermediate certs have not been loaded in by TUF
+				pool := x509.NewCertPool()
+				for _, cert := range chain[:len(chain)-1] {
+					pool.AddCert(cert)
+				}
+				co.IntermediateCerts = pool
 			}
-			co.IntermediateCerts = pool
 		}
 		verifier, err = ValidateAndUnpackCert(cert, co)
 		if err != nil {
@@ -676,6 +654,7 @@ func verifyInternal(ctx context.Context, sig oci.Signature, h v1.Hash,
 		}
 	}
 
+	// 1. Perform cryptographic verification of the signature using the certificate's public key.
 	if err := verifyFn(ctx, verifier, sig); err != nil {
 		return bundleVerified, err
 	}
@@ -686,43 +665,93 @@ func verifyInternal(ctx context.Context, sig oci.Signature, h v1.Hash,
 			return bundleVerified, err
 		}
 	}
-	if co.TSAClient != nil {
-		bundleVerified, err = VerifyTSABundle(ctx, sig, co.TSAClient, co.TSACerts)
+	if co.TSACerts != nil {
+		bundleVerified, err = VerifyRFC3161Timestamp(ctx, sig, co.TSACerts)
 		if err != nil {
-			return false, fmt.Errorf("unable to verify TSA bundle: %w", err)
+			return false, fmt.Errorf("unable to verify RFC3161 timestamp bundle: %w", err)
 		}
 	}
 	if co.SkipTlogVerify {
 		return bundleVerified, nil
 	}
 
-	bundleVerified, err = VerifyBundle(ctx, sig, co.RekorClient)
+	// 2. Check the validity time of the signature.
+	// This is the signature creation time. As a default upper bound, use the current
+	// time.
+	validityTime := time.Now()
+
+	bundleVerified, err = VerifyBundle(ctx, sig, co, co.RekorClient)
 	if err != nil {
 		return false, fmt.Errorf("error verifying bundle: %w", err)
 	}
 
-	// If the --offline flag was specified, fail here
+	if bundleVerified {
+		// Update with the verified bundle's integrated time.
+		validityTime, err = getBundleIntegratedTime(sig)
+		if err != nil {
+			return false, fmt.Errorf("error getting bundle integrated time: %w", err)
+		}
+	}
+
+	// If the --offline flag was specified, fail here. bundleVerified returns false with
+	// no error when there was no bundle provided.
+	// TODO: You can be offline when you are verifying with a public key. This shouldn't
+	// error out, but maybe should be a log message.
 	if !bundleVerified && co.Offline {
 		return false, fmt.Errorf("offline verification failed")
 	}
 
-	if !bundleVerified && co.RekorClient != nil {
-		if co.SigVerifier != nil {
-			pub, err := co.SigVerifier.PublicKey(co.PKOpts...)
-			if err != nil {
-				return bundleVerified, err
-			}
-			return bundleVerified, tlogValidatePublicKey(ctx, co.RekorClient, pub, sig)
+	cert, err := sig.Cert()
+	if err != nil {
+		return false, err
+	}
+	if !bundleVerified && co.RekorClient != nil && !co.Offline {
+		pemBytes, err := keyBytes(sig, co)
+		if err != nil {
+			return bundleVerified, err
+		}
+
+		e, err := tlogValidateEntry(ctx, co.RekorClient, sig, pemBytes)
+		if err != nil {
+			return bundleVerified, err
 		}
+		validityTime = time.Unix(*e.IntegratedTime, 0)
+	}
 
-		return bundleVerified, tlogValidateCertificate(ctx, co.RekorClient, sig)
+	// 3. if a certificate was used, verify the cert against the integrated time.
+	if cert != nil {
+		if err := CheckExpiry(cert, validityTime); err != nil {
+			return false, fmt.Errorf("checking expiry on cert: %w", err)
+		}
 	}
+
 	return bundleVerified, nil
 }
 
+func keyBytes(sig oci.Signature, co *CheckOpts) ([]byte, error) {
+	cert, err := sig.Cert()
+	if err != nil {
+		return nil, err
+	}
+	// We have a public key.
+	if co.SigVerifier != nil {
+		pub, err := co.SigVerifier.PublicKey(co.PKOpts...)
+		if err != nil {
+			return nil, err
+		}
+		return cryptoutils.MarshalPublicKeyToPEM(pub)
+	}
+	return cryptoutils.MarshalCertificateToPEM(cert)
+}
+
+// VerifyBlobSignature verifies a blob signature.
+func VerifyBlobSignature(ctx context.Context, sig oci.Signature, co *CheckOpts) (bundleVerified bool, err error) {
+	// The hash of the artifact is unused.
+	return verifyInternal(ctx, sig, v1.Hash{}, verifyOCISignature, co)
+}
+
 // VerifyImageSignature verifies a signature
-func VerifyImageSignature(ctx context.Context, sig oci.Signature,
-	h v1.Hash, co *CheckOpts) (bundleVerified bool, err error) {
+func VerifyImageSignature(ctx context.Context, sig oci.Signature, h v1.Hash, co *CheckOpts) (bundleVerified bool, err error) {
 	return verifyInternal(ctx, sig, h, verifyOCISignature, co)
 }
 
@@ -841,6 +870,13 @@ func VerifyLocalImageAttestations(ctx context.Context, path string, co *CheckOpt
 	return verifyImageAttestations(ctx, atts, h, co)
 }
 
+func VerifyBlobAttestation(ctx context.Context, att oci.Signature, co *CheckOpts) (
+	bool, error) {
+	// A blob attestation does not have an associated artifact (currently) to check the claims against.
+	// So we can safely add a nil hash.
+	return verifyInternal(ctx, att, v1.Hash{}, verifyOCIAttestation, co)
+}
+
 func verifyImageAttestations(ctx context.Context, atts oci.Signatures, h v1.Hash, co *CheckOpts) (checkedAttestations []oci.Signature, bundleVerified bool, err error) {
 	sl, err := atts.Get()
 	if err != nil {
@@ -888,7 +924,17 @@ func CheckExpiry(cert *x509.Certificate, it time.Time) error {
 	return nil
 }
 
-func VerifyBundle(ctx context.Context, sig oci.Signature, rekorClient *client.Rekor) (bool, error) {
+func getBundleIntegratedTime(sig oci.Signature) (time.Time, error) {
+	bundle, err := sig.Bundle()
+	if err != nil {
+		return time.Now(), err
+	} else if bundle == nil {
+		return time.Now(), nil
+	}
+	return time.Unix(bundle.Payload.IntegratedTime, 0), nil
+}
+
+func VerifyBundle(ctx context.Context, sig oci.Signature, co *CheckOpts, rekorClient *client.Rekor) (bool, error) {
 	bundle, err := sig.Bundle()
 	if err != nil {
 		return false, err
@@ -900,6 +946,10 @@ func VerifyBundle(ctx context.Context, sig oci.Signature, rekorClient *client.Re
 		return false, err
 	}
 
+	if err := comparePublicKey(bundle.Payload.Body.(string), sig, co); err != nil {
+		return false, err
+	}
+
 	publicKeys, err := GetRekorPubs(ctx, nil)
 	if err != nil {
 		return false, fmt.Errorf("retrieving rekor public key: %w", err)
@@ -917,19 +967,6 @@ func VerifyBundle(ctx context.Context, sig oci.Signature, rekorClient *client.Re
 		fmt.Fprintf(os.Stderr, "**Info** Successfully verified Rekor entry using an expired verification key\n")
 	}
 
-	cert, err := sig.Cert()
-	if err != nil {
-		return false, err
-	}
-
-	if cert != nil {
-		// Verify the cert against the integrated time.
-		// Note that if the caller requires the certificate to be present, it has to ensure that itself.
-		if err := CheckExpiry(cert, time.Unix(bundle.Payload.IntegratedTime, 0)); err != nil {
-			return false, fmt.Errorf("checking expiry on cert: %w", err)
-		}
-	}
-
 	payload, err := sig.Payload()
 	if err != nil {
 		return false, fmt.Errorf("reading payload: %w", err)
@@ -949,8 +986,8 @@ func VerifyBundle(ctx context.Context, sig oci.Signature, rekorClient *client.Re
 	return true, nil
 }
 
-func VerifyTSABundle(ctx context.Context, sig oci.Signature, tsaClient *tsaclient.TimestampAuthority, tsaCerts *x509.CertPool) (bool, error) {
-	bundle, err := sig.TSABundle()
+func VerifyRFC3161Timestamp(ctx context.Context, sig oci.Signature, tsaCerts *x509.CertPool) (bool, error) {
+	bundle, err := sig.RFC3161Timestamp()
 	if err != nil {
 		return false, err
 	} else if bundle == nil {
@@ -1017,6 +1054,40 @@ func compareSigs(bundleBody string, sig oci.Signature) error {
 	return nil
 }
 
+func comparePublicKey(bundleBody string, sig oci.Signature, co *CheckOpts) error {
+	pemBytes, err := keyBytes(sig, co)
+	if err != nil {
+		return err
+	}
+
+	bundleKey, err := bundleKey(bundleBody)
+	if err != nil {
+		return fmt.Errorf("failed to extract key from bundle: %w", err)
+	}
+
+	decodeSecond, err := base64.StdEncoding.DecodeString(bundleKey)
+	if err != nil {
+		return fmt.Errorf("decoding base64 string %s", bundleKey)
+	}
+
+	// Compare the PEM bytes, to ignore spurious newlines in the public key bytes.
+	pemFirst, rest := pem.Decode(pemBytes)
+	if len(rest) > 0 {
+		return fmt.Errorf("unexpected PEM block: %s", rest)
+	}
+	pemSecond, rest := pem.Decode(decodeSecond)
+	if len(rest) > 0 {
+		return fmt.Errorf("unexpected PEM block: %s", rest)
+	}
+
+	if !bytes.Equal(pemFirst.Bytes, pemSecond.Bytes) {
+		return fmt.Errorf("comparing public key PEMs, expected %s, got %s",
+			pemBytes, decodeSecond)
+	}
+
+	return nil
+}
+
 func bundleHash(bundleBody, signature string) (string, string, error) {
 	var toto models.Intoto
 	var rekord models.Rekord
@@ -1116,6 +1187,58 @@ func bundleSig(bundleBody string) (string, error) {
 	return hrekordObj.Signature.Content.String(), nil
 }
 
+// bundleKey extracts the key from the rekor bundle body
+func bundleKey(bundleBody string) (string, error) {
+	var rekord models.Rekord
+	var hrekord models.Hashedrekord
+	var intotod models.Intoto
+	var rekordObj models.RekordV001Schema
+	var hrekordObj models.HashedrekordV001Schema
+	var intotodObj models.IntotoV001Schema
+
+	bodyDecoded, err := base64.StdEncoding.DecodeString(bundleBody)
+	if err != nil {
+		return "", fmt.Errorf("decoding bundleBody: %w", err)
+	}
+
+	// Try Rekord
+	if err := json.Unmarshal(bodyDecoded, &rekord); err == nil {
+		specMarshal, err := json.Marshal(rekord.Spec)
+		if err != nil {
+			return "", err
+		}
+		if err := json.Unmarshal(specMarshal, &rekordObj); err != nil {
+			return "", err
+		}
+		return rekordObj.Signature.PublicKey.Content.String(), nil
+	}
+
+	// Try hashedRekordObj
+	if err := json.Unmarshal(bodyDecoded, &hrekord); err == nil {
+		specMarshal, err := json.Marshal(hrekord.Spec)
+		if err != nil {
+			return "", err
+		}
+		if err := json.Unmarshal(specMarshal, &hrekordObj); err != nil {
+			return "", err
+		}
+		return hrekordObj.Signature.PublicKey.Content.String(), nil
+	}
+
+	// Try Intoto
+	if err := json.Unmarshal(bodyDecoded, &intotod); err != nil {
+		return "", err
+	}
+	specMarshal, err := json.Marshal(intotod.Spec)
+	if err != nil {
+		return "", err
+	}
+	if err := json.Unmarshal(specMarshal, &intotodObj); err != nil {
+		return "", err
+	}
+	return intotodObj.PublicKey.String(), nil
+}
+
 func VerifySET(bundlePayload cbundle.RekorPayload, signature []byte, pub *ecdsa.PublicKey) error {
 	contents, err := json.Marshal(bundlePayload)
 	if err != nil {
diff --git a/pkg/oci/internal/signature/layer.go b/pkg/oci/internal/signature/layer.go
index 35b1c29e..98f372ff 100644
--- a/pkg/oci/internal/signature/layer.go
+++ b/pkg/oci/internal/signature/layer.go
@@ -29,11 +29,11 @@ import (
 )
 
 const (
-	sigkey       = "dev.cosignproject.cosign/signature"
-	certkey      = "dev.sigstore.cosign/certificate"
-	chainkey     = "dev.sigstore.cosign/chain"
-	BundleKey    = "dev.sigstore.cosign/bundle"
-	TSABundleKey = "dev.sigstore.cosign/3161timestamp"
+	sigkey              = "dev.cosignproject.cosign/signature"
+	certkey             = "dev.sigstore.cosign/certificate"
+	chainkey            = "dev.sigstore.cosign/chain"
+	BundleKey           = "dev.sigstore.cosign/bundle"
+	RFC3161TimestampKey = "dev.sigstore.cosign/3161timestamp"
 )
 
 type sigLayer struct {
@@ -117,15 +117,15 @@ func (s *sigLayer) Bundle() (*bundle.RekorBundle, error) {
 	return &b, nil
 }
 
-// TSABundle implements oci.Signature
-func (s *sigLayer) TSABundle() (*bundle.TSABundle, error) {
-	val := s.desc.Annotations[TSABundleKey]
+// RFC3161Timestamp implements oci.Signature
+func (s *sigLayer) RFC3161Timestamp() (*bundle.RFC3161Timestamp, error) {
+	val := s.desc.Annotations[RFC3161TimestampKey]
 	if val == "" {
 		return nil, nil
 	}
-	var b bundle.TSABundle
+	var b bundle.RFC3161Timestamp
 	if err := json.Unmarshal([]byte(val), &b); err != nil {
-		return nil, fmt.Errorf("unmarshaling tsa bundle: %w", err)
+		return nil, fmt.Errorf("unmarshaling RFC3161 timestamp bundle: %w", err)
 	}
 	return &b, nil
 }
diff --git a/pkg/oci/mutate/options.go b/pkg/oci/mutate/options.go
index 35e9282f..98e8cd2b 100644
--- a/pkg/oci/mutate/options.go
+++ b/pkg/oci/mutate/options.go
@@ -60,12 +60,12 @@ func WithReplaceOp(ro ReplaceOp) SignOption {
 }
 
 type signatureOpts struct {
-	annotations map[string]string
-	bundle      *bundle.RekorBundle
-	tsaBundle   *bundle.TSABundle
-	cert        []byte
-	chain       []byte
-	mediaType   types.MediaType
+	annotations      map[string]string
+	bundle           *bundle.RekorBundle
+	rfc3161Timestamp *bundle.RFC3161Timestamp
+	cert             []byte
+	chain            []byte
+	mediaType        types.MediaType
 }
 
 type SignatureOption func(*signatureOpts)
@@ -84,10 +84,10 @@ func WithBundle(b *bundle.RekorBundle) SignatureOption {
 	}
 }
 
-// WithTSABundle specifies the new TSABundle the Signature should have.
-func WithTSABundle(b *bundle.TSABundle) SignatureOption {
+// WithRFC3161Timestamp specifies the new RFC3161Timestamp the Signature should have.
+func WithRFC3161Timestamp(b *bundle.RFC3161Timestamp) SignatureOption {
 	return func(so *signatureOpts) {
-		so.tsaBundle = b
+		so.rfc3161Timestamp = b
 	}
 }
 
diff --git a/pkg/oci/mutate/signature.go b/pkg/oci/mutate/signature.go
index 0955a4af..84e2226b 100644
--- a/pkg/oci/mutate/signature.go
+++ b/pkg/oci/mutate/signature.go
@@ -32,12 +32,12 @@ import (
 type sigWrapper struct {
 	wrapped oci.Signature
 
-	annotations map[string]string
-	bundle      *bundle.RekorBundle
-	tsaBundle   *bundle.TSABundle
-	cert        *x509.Certificate
-	chain       []*x509.Certificate
-	mediaType   types.MediaType
+	annotations      map[string]string
+	bundle           *bundle.RekorBundle
+	rfc3161Timestamp *bundle.RFC3161Timestamp
+	cert             *x509.Certificate
+	chain            []*x509.Certificate
+	mediaType        types.MediaType
 }
 
 var _ v1.Layer = (*sigWrapper)(nil)
@@ -93,12 +93,12 @@ func (sw *sigWrapper) Bundle() (*bundle.RekorBundle, error) {
 	return sw.wrapped.Bundle()
 }
 
-// TSABundle implements oci.Signature.
-func (sw *sigWrapper) TSABundle() (*bundle.TSABundle, error) {
-	if sw.tsaBundle != nil {
-		return sw.tsaBundle, nil
+// RFC3161Timestamp implements oci.Signature.
+func (sw *sigWrapper) RFC3161Timestamp() (*bundle.RFC3161Timestamp, error) {
+	if sw.rfc3161Timestamp != nil {
+		return sw.rfc3161Timestamp, nil
 	}
-	return sw.wrapped.TSABundle()
+	return sw.wrapped.RFC3161Timestamp()
 }
 
 // MediaType implements v1.Layer
@@ -148,7 +148,7 @@ func Signature(original oci.Signature, opts ...SignatureOption) (oci.Signature,
 	if so.annotations != nil {
 		newAnn = copyAnnotations(so.annotations)
 		newAnn[static.SignatureAnnotationKey] = oldAnn[static.SignatureAnnotationKey]
-		for _, key := range []string{static.BundleAnnotationKey, static.CertificateAnnotationKey, static.ChainAnnotationKey, static.TSABundleAnnotationKey} {
+		for _, key := range []string{static.BundleAnnotationKey, static.CertificateAnnotationKey, static.ChainAnnotationKey, static.RFC3161TimestampAnnotationKey} {
 			if val, isSet := oldAnn[key]; isSet {
 				newAnn[key] = val
 			} else {
@@ -168,13 +168,13 @@ func Signature(original oci.Signature, opts ...SignatureOption) (oci.Signature,
 		newAnn[static.BundleAnnotationKey] = string(b)
 	}
 
-	if so.tsaBundle != nil {
-		newSig.tsaBundle = so.tsaBundle
-		b, err := json.Marshal(so.tsaBundle)
+	if so.rfc3161Timestamp != nil {
+		newSig.rfc3161Timestamp = so.rfc3161Timestamp
+		b, err := json.Marshal(so.rfc3161Timestamp)
 		if err != nil {
 			return nil, err
 		}
-		newAnn[static.TSABundleAnnotationKey] = string(b)
+		newAnn[static.RFC3161TimestampAnnotationKey] = string(b)
 	}
 
 	if so.cert != nil {
diff --git a/pkg/oci/signature/layer.go b/pkg/oci/signature/layer.go
index 35b1c29e..0ec4f4e0 100644
--- a/pkg/oci/signature/layer.go
+++ b/pkg/oci/signature/layer.go
@@ -29,11 +29,11 @@ import (
 )
 
 const (
-	sigkey       = "dev.cosignproject.cosign/signature"
-	certkey      = "dev.sigstore.cosign/certificate"
-	chainkey     = "dev.sigstore.cosign/chain"
-	BundleKey    = "dev.sigstore.cosign/bundle"
-	TSABundleKey = "dev.sigstore.cosign/3161timestamp"
+	sigkey              = "dev.cosignproject.cosign/signature"
+	certkey             = "dev.sigstore.cosign/certificate"
+	chainkey            = "dev.sigstore.cosign/chain"
+	BundleKey           = "dev.sigstore.cosign/bundle"
+	RFC3161TimestampKey = "dev.sigstore.cosign/rfc3161timestamp"
 )
 
 type sigLayer struct {
@@ -117,15 +117,15 @@ func (s *sigLayer) Bundle() (*bundle.RekorBundle, error) {
 	return &b, nil
 }
 
-// TSABundle implements oci.Signature
-func (s *sigLayer) TSABundle() (*bundle.TSABundle, error) {
-	val := s.desc.Annotations[TSABundleKey]
+// RFC3161Timestamp implements oci.Signature
+func (s *sigLayer) RFC3161Timestamp() (*bundle.RFC3161Timestamp, error) {
+	val := s.desc.Annotations[RFC3161TimestampKey]
 	if val == "" {
 		return nil, nil
 	}
-	var b bundle.TSABundle
+	var b bundle.RFC3161Timestamp
 	if err := json.Unmarshal([]byte(val), &b); err != nil {
-		return nil, fmt.Errorf("unmarshaling tsa bundle: %w", err)
+		return nil, fmt.Errorf("unmarshaling RFC3161 timestamp bundle: %w", err)
 	}
 	return &b, nil
 }
diff --git a/pkg/oci/signatures.go b/pkg/oci/signatures.go
index cec3d5bb..64cf50e0 100644
--- a/pkg/oci/signatures.go
+++ b/pkg/oci/signatures.go
@@ -60,7 +60,7 @@ type Signature interface {
 	// Fulcio key in the transparency log.
 	Bundle() (*bundle.RekorBundle, error)
 
-	// TSABundle fetches the optional metadata that records a
+	// RFC3161Timestamp() fetches the optional metadata that records a
 	// RFC3161 signed timestamp.
-	TSABundle() (*bundle.TSABundle, error)
+	RFC3161Timestamp() (*bundle.RFC3161Timestamp, error)
 }
diff --git a/pkg/oci/static/options.go b/pkg/oci/static/options.go
index 62f7960e..db4968b2 100644
--- a/pkg/oci/static/options.go
+++ b/pkg/oci/static/options.go
@@ -27,13 +27,13 @@ import (
 type Option func(*options)
 
 type options struct {
-	LayerMediaType  types.MediaType
-	ConfigMediaType types.MediaType
-	Bundle          *bundle.RekorBundle
-	TSABundle       *bundle.TSABundle
-	Cert            []byte
-	Chain           []byte
-	Annotations     map[string]string
+	LayerMediaType   types.MediaType
+	ConfigMediaType  types.MediaType
+	Bundle           *bundle.RekorBundle
+	RFC3161Timestamp *bundle.RFC3161Timestamp
+	Cert             []byte
+	Chain            []byte
+	Annotations      map[string]string
 }
 
 func makeOptions(opts ...Option) (*options, error) {
@@ -60,12 +60,12 @@ func makeOptions(opts ...Option) (*options, error) {
 		o.Annotations[BundleAnnotationKey] = string(b)
 	}
 
-	if o.TSABundle != nil {
-		b, err := json.Marshal(o.TSABundle)
+	if o.RFC3161Timestamp != nil {
+		b, err := json.Marshal(o.RFC3161Timestamp)
 		if err != nil {
 			return nil, err
 		}
-		o.Annotations[TSABundleAnnotationKey] = string(b)
+		o.Annotations[RFC3161TimestampAnnotationKey] = string(b)
 	}
 	return o, nil
 }
@@ -98,10 +98,10 @@ func WithBundle(b *bundle.RekorBundle) Option {
 	}
 }
 
-// WithTSABundle sets the time-stamping bundle to attach to the signature
-func WithTSABundle(b *bundle.TSABundle) Option {
+// WithRFC3161Timestamp sets the time-stamping bundle to attach to the signature
+func WithRFC3161Timestamp(b *bundle.RFC3161Timestamp) Option {
 	return func(o *options) {
-		o.TSABundle = b
+		o.RFC3161Timestamp = b
 	}
 }
 
diff --git a/pkg/oci/static/signature.go b/pkg/oci/static/signature.go
index aa5044ec..5e9c4f6e 100644
--- a/pkg/oci/static/signature.go
+++ b/pkg/oci/static/signature.go
@@ -28,11 +28,11 @@ import (
 )
 
 const (
-	SignatureAnnotationKey   = "dev.cosignproject.cosign/signature"
-	CertificateAnnotationKey = "dev.sigstore.cosign/certificate"
-	ChainAnnotationKey       = "dev.sigstore.cosign/chain"
-	BundleAnnotationKey      = "dev.sigstore.cosign/bundle"
-	TSABundleAnnotationKey   = "dev.sigstore.cosign/3161timestamp"
+	SignatureAnnotationKey        = "dev.cosignproject.cosign/signature"
+	CertificateAnnotationKey      = "dev.sigstore.cosign/certificate"
+	ChainAnnotationKey            = "dev.sigstore.cosign/chain"
+	BundleAnnotationKey           = "dev.sigstore.cosign/bundle"
+	RFC3161TimestampAnnotationKey = "dev.sigstore.cosign/rfc3161timestamp"
 )
 
 // NewSignature constructs a new oci.Signature from the provided options.
@@ -86,11 +86,11 @@ func Copy(sig oci.Signature) (oci.Signature, error) {
 	}
 	opts = append(opts, WithBundle(bundle))
 
-	tsaBundle, err := sig.TSABundle()
+	rfc3161Timestamp, err := sig.RFC3161Timestamp()
 	if err != nil {
 		return nil, err
 	}
-	opts = append(opts, WithTSABundle(tsaBundle))
+	opts = append(opts, WithRFC3161Timestamp(rfc3161Timestamp))
 
 	cert, err := sig.Cert()
 	if err != nil {
@@ -169,9 +169,9 @@ func (l *staticLayer) Bundle() (*bundle.RekorBundle, error) {
 	return l.opts.Bundle, nil
 }
 
-// TSABundle implements oci.Signature
-func (l *staticLayer) TSABundle() (*bundle.TSABundle, error) {
-	return l.opts.TSABundle, nil
+// RFC3161Timestamp implements oci.Signature
+func (l *staticLayer) RFC3161Timestamp() (*bundle.RFC3161Timestamp, error) {
+	return l.opts.RFC3161Timestamp, nil
 }
 
 // Digest implements v1.Layer


Test patch:
diff --git a/.github/workflows/e2e_tests.yml b/.github/workflows/e2e-tests.yml
similarity index 76%
rename from .github/workflows/e2e_tests.yml
rename to .github/workflows/e2e-tests.yml
index 0dfa1567..9681c8d0 100644
--- a/.github/workflows/e2e_tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -30,17 +30,19 @@ on:
       - "main"
   workflow_dispatch:
 
-permissions: read-all
-
 jobs:
   e2e-tests:
     # Skip if running in a fork that might not have secrets configured.
     if: ${{ github.repository == 'sigstore/cosign' }}
     name: Run tests
-    runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [macos-latest, ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
@@ -48,16 +50,21 @@ jobs:
         with:
           go-version: '1.19'
           check-latest: true
-      - name: Set up Cloud SDK
-        uses: google-github-actions/setup-gcloud@d51b5346f85640ec2aa2fa057354d2b82c2fcbce # v1.0.1
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d # v1.0.0
         with:
-          project_id: projectsigstore
-          service_account_key: ${{ secrets.GCP_CI_SERVICE_ACCOUNT }}
-          export_default_credentials: true
-      - name: Set up `crane`
-        run: go install github.com/google/go-containerregistry/cmd/crane@v0.8.0
+          workload_identity_provider: 'projects/498091336538/locations/global/workloadIdentityPools/githubactions/providers/sigstore-cosign'
+          service_account: 'github-actions-e2e@projectsigstore.iam.gserviceaccount.com'
+
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@d51b5346f85640ec2aa2fa057354d2b82c2fcbce # v1.0.1
+
+      - uses: imjasonh/setup-crane@e82f1b9a8007d399333baba4d75915558e9fb6a4 # v0.2
+
       - name: gcloud auth configure-docker
         run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
       - name: Run e2e_test_secrets.sh
         shell: bash
         run: ./test/e2e_test_secrets.sh
diff --git a/.github/workflows/scorecard_action.yml b/.github/workflows/scorecard-action.yml
similarity index 100%
rename from .github/workflows/scorecard_action.yml
rename to .github/workflows/scorecard-action.yml
diff --git a/cmd/cosign/cli/attest/attest.go b/cmd/cosign/cli/attest/attest.go
index d9e10f3d..a62a20a5 100644
--- a/cmd/cosign/cli/attest/attest.go
+++ b/cmd/cosign/cli/attest/attest.go
@@ -166,7 +166,7 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {
 	}
 
 	// Check whether we should be uploading to the transparency log
-	if sign.ShouldUploadToTlog(ctx, c.KeyOpts, digest, c.SkipConfirmation, c.TlogUpload) {
+	if sign.ShouldUploadToTlog(ctx, c.KeyOpts, digest, c.SkipConfirmation, c.TlogUpload, "") {
 		bundle, err := uploadToTlog(ctx, sv, c.RekorURL, func(r *client.Rekor, b []byte) (*models.LogEntryAnon, error) {
 			return cosign.TLogUploadInTotoAttestation(ctx, r, signedPayload, b)
 		})
diff --git a/cmd/cosign/cli/verify/verify_blob_test.go b/cmd/cosign/cli/verify/verify_blob_test.go
index 5a0ac7cf..b2c1b7f5 100644
--- a/cmd/cosign/cli/verify/verify_blob_test.go
+++ b/cmd/cosign/cli/verify/verify_blob_test.go
@@ -27,6 +27,8 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
@@ -38,13 +40,11 @@ import (
 	"github.com/go-openapi/swag"
 	ssldsse "github.com/secure-systems-lab/go-securesystemslib/dsse"
 	"github.com/sigstore/cosign/cmd/cosign/cli/options"
-	"github.com/sigstore/cosign/internal/pkg/cosign/rekor/mock"
 	"github.com/sigstore/cosign/pkg/cosign"
 	"github.com/sigstore/cosign/pkg/cosign/bundle"
 	sigs "github.com/sigstore/cosign/pkg/signature"
 	ctypes "github.com/sigstore/cosign/pkg/types"
 	"github.com/sigstore/cosign/test"
-	"github.com/sigstore/rekor/pkg/generated/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	"github.com/sigstore/rekor/pkg/pki"
 	"github.com/sigstore/rekor/pkg/types"
@@ -81,14 +81,14 @@ func TestSignaturesRef(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.description, func(t *testing.T) {
-			gotSig, err := signatures(test.sigRef, "")
+			gotSig, err := base64signature(test.sigRef, "")
 			if test.shouldErr && err != nil {
 				return
 			}
 			if test.shouldErr {
 				t.Fatal("should have received an error")
 			}
-			if gotSig != sig {
+			if gotSig != b64sig {
 				t.Fatalf("unexpected signature, expected: %s got: %s", sig, gotSig)
 			}
 		})
@@ -99,7 +99,6 @@ func TestSignaturesBundle(t *testing.T) {
 	td := t.TempDir()
 	fp := filepath.Join(td, "file")
 
-	sig := "a=="
 	b64sig := "YT09"
 
 	// save as a LocalSignedPayload to the file
@@ -114,12 +113,12 @@ func TestSignaturesBundle(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	gotSig, err := signatures("", fp)
+	gotSig, err := base64signature("", fp)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if gotSig != sig {
-		t.Fatalf("unexpected signature, expected: %s got: %s", sig, gotSig)
+	if gotSig != b64sig {
+		t.Fatalf("unexpected signature, expected: %s got: %s", b64sig, gotSig)
 	}
 }
 
@@ -194,6 +193,9 @@ func TestVerifyBlob(t *testing.T) {
 	rootCert, rootPriv, _ := test.GenerateRootCa()
 	rootPool := x509.NewCertPool()
 	rootPool.AddCert(rootCert)
+	chain, _ := cryptoutils.MarshalCertificatesToPEM([]*x509.Certificate{rootCert})
+	chainPath := writeBlobFile(t, td, string(chain), "chain.pem")
+
 	unexpiredLeafCert, _ := test.GenerateLeafCertWithExpiration(identity, issuer,
 		time.Now(), leafPriv, rootCert, rootPriv)
 	unexpiredCertPem, _ := cryptoutils.MarshalCertificateToPEM(unexpiredLeafCert)
@@ -215,15 +217,8 @@ func TestVerifyBlob(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	tmpRekorPubFile, err := os.CreateTemp(td, "cosign_rekor_pub_*.key")
-	if err != nil {
-		t.Fatalf("failed to create temp rekor pub file: %v", err)
-	}
-	defer tmpRekorPubFile.Close()
-	if _, err := tmpRekorPubFile.Write(pemRekor); err != nil {
-		t.Fatalf("failed to write rekor pub file: %v", err)
-	}
-	t.Setenv("SIGSTORE_REKOR_PUBLIC_KEY", tmpRekorPubFile.Name())
+	tmpRekorPubFile := writeBlobFile(t, td, string(pemRekor), "rekor_pub.key")
+	t.Setenv("SIGSTORE_REKOR_PUBLIC_KEY", tmpRekorPubFile)
 
 	var makeSignature = func(blob []byte) string {
 		sig, err := signer.SignMessage(bytes.NewReader(blob))
@@ -239,12 +234,12 @@ func TestVerifyBlob(t *testing.T) {
 	otherSignature := makeSignature(otherBytes)
 
 	tts := []struct {
-		name        string
-		blob        []byte
-		signature   string
-		sigVerifier signature.Verifier
-		cert        *x509.Certificate
-		bundlePath  string
+		name       string
+		blob       []byte
+		signature  string
+		key        []byte
+		cert       *x509.Certificate
+		bundlePath string
 		// If online lookups to Rekor are enabled
 		experimental bool
 		// The rekor entry response when Rekor is enabled
@@ -255,24 +250,28 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with public key",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: false,
 			shouldErr:    false,
 		},
+		/* TODO:
+		This currently passes without error because we don't require an experimental
+		lookup for public keys. Add this test back in when we have a --verify-tlog-online
 		{
 			name:         "valid signature with public key - experimental no rekor fail",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: true,
 			rekorEntry:   nil,
 			shouldErr:    true,
 		},
+		*/
 		{
 			name:         "valid signature with public key - experimental rekor entry success",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: true,
 			rekorEntry: []*models.LogEntry{makeRekorEntry(t, *rekorSigner, blobBytes, []byte(blobSignature),
 				pubKeyBytes, true)},
@@ -282,7 +281,7 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with public key - good bundle provided",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: false,
 			bundlePath: makeLocalBundle(t, *rekorSigner, blobBytes, []byte(blobSignature),
 				pubKeyBytes, true),
@@ -292,7 +291,7 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with public key - bundle without rekor bundle fails",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: false,
 			bundlePath:   makeLocalBundleWithoutRekorBundle(t, []byte(blobSignature), pubKeyBytes),
 			shouldErr:    false,
@@ -301,7 +300,7 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with public key - bad bundle SET",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: false,
 			bundlePath: makeLocalBundle(t, *signer, blobBytes, []byte(blobSignature),
 				unexpiredCertPem, true),
@@ -311,7 +310,7 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with public key - bad bundle cert mismatch",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: false,
 			bundlePath: makeLocalBundle(t, *rekorSigner, blobBytes, []byte(blobSignature),
 				unexpiredCertPem, true),
@@ -321,7 +320,7 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with public key - bad bundle signature mismatch",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: false,
 			bundlePath: makeLocalBundle(t, *rekorSigner, blobBytes, []byte(makeSignature(blobBytes)),
 				pubKeyBytes, true),
@@ -331,7 +330,7 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with public key - bad bundle msg & signature mismatch",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: false,
 			bundlePath: makeLocalBundle(t, *rekorSigner, otherBytes, []byte(otherSignature),
 				pubKeyBytes, true),
@@ -341,7 +340,7 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "invalid signature with public key",
 			blob:         blobBytes,
 			signature:    otherSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: false,
 			shouldErr:    true,
 		},
@@ -349,35 +348,32 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "invalid signature with public key - experimental",
 			blob:         blobBytes,
 			signature:    otherSignature,
-			sigVerifier:  signer,
+			key:          pubKeyBytes,
 			experimental: true,
 			shouldErr:    true,
 		},
 		{
-			name:         "valid signature with unexpired certificate",
+			name:         "valid signature with unexpired certificate - no rekor entry",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			cert:         unexpiredLeafCert,
 			experimental: false,
-			shouldErr:    false,
+			shouldErr:    true,
 		},
 		{
 			name:         "valid signature with unexpired certificate - bad bundle cert mismatch",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			experimental: false,
-			cert:         unexpiredLeafCert,
+			key:          pubKeyBytes,
 			bundlePath: makeLocalBundle(t, *rekorSigner, blobBytes, []byte(blobSignature),
-				pubKeyBytes, true),
+				unexpiredCertPem, true),
 			shouldErr: true,
 		},
 		{
 			name:         "valid signature with unexpired certificate - bad bundle signature mismatch",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			experimental: false,
 			cert:         unexpiredLeafCert,
 			bundlePath: makeLocalBundle(t, *rekorSigner, blobBytes, []byte(makeSignature(blobBytes)),
@@ -388,7 +384,6 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with unexpired certificate - bad bundle msg & signature mismatch",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			experimental: false,
 			cert:         unexpiredLeafCert,
 			bundlePath: makeLocalBundle(t, *rekorSigner, otherBytes, []byte(otherSignature),
@@ -399,7 +394,6 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "invalid signature with unexpired certificate",
 			blob:         blobBytes,
 			signature:    otherSignature,
-			sigVerifier:  signer,
 			cert:         unexpiredLeafCert,
 			experimental: false,
 			shouldErr:    true,
@@ -409,7 +403,6 @@ func TestVerifyBlob(t *testing.T) {
 			blob:         blobBytes,
 			signature:    blobSignature,
 			cert:         unexpiredLeafCert,
-			sigVerifier:  signer,
 			experimental: true,
 			rekorEntry: []*models.LogEntry{makeRekorEntry(t, *rekorSigner, blobBytes, []byte(blobSignature),
 				unexpiredCertPem, true)},
@@ -430,7 +423,6 @@ func TestVerifyBlob(t *testing.T) {
 			blob:         blobBytes,
 			signature:    blobSignature,
 			cert:         expiredLeafCert,
-			sigVerifier:  signer,
 			experimental: false,
 			shouldErr:    true,
 		},
@@ -438,7 +430,6 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with expired certificate - experimental good rekor lookup",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			cert:         expiredLeafCert,
 			experimental: true,
 			rekorEntry: []*models.LogEntry{makeRekorEntry(t, *rekorSigner, blobBytes, []byte(blobSignature),
@@ -449,7 +440,6 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with expired certificate - experimental multiple rekor entries",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			cert:         expiredLeafCert,
 			experimental: true,
 			rekorEntry: []*models.LogEntry{makeRekorEntry(t, *rekorSigner, blobBytes, []byte(blobSignature),
@@ -462,7 +452,6 @@ func TestVerifyBlob(t *testing.T) {
 			blob:         blobBytes,
 			signature:    blobSignature,
 			cert:         expiredLeafCert,
-			sigVerifier:  signer,
 			experimental: true,
 			rekorEntry: []*models.LogEntry{makeRekorEntry(t, *rekorSigner, blobBytes, []byte(blobSignature),
 				expiredLeafPem, false)},
@@ -474,7 +463,6 @@ func TestVerifyBlob(t *testing.T) {
 			blob:         blobBytes,
 			signature:    blobSignature,
 			cert:         unexpiredLeafCert,
-			sigVerifier:  signer,
 			experimental: false,
 			bundlePath: makeLocalBundle(t, *rekorSigner, blobBytes, []byte(blobSignature),
 				unexpiredCertPem, true),
@@ -485,7 +473,6 @@ func TestVerifyBlob(t *testing.T) {
 			blob:         blobBytes,
 			signature:    blobSignature,
 			cert:         expiredLeafCert,
-			sigVerifier:  signer,
 			experimental: false,
 			bundlePath: makeLocalBundle(t, *rekorSigner, blobBytes, []byte(blobSignature),
 				expiredLeafPem, true),
@@ -495,7 +482,6 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with expired certificate - bundle with bad expiration",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			cert:         expiredLeafCert,
 			experimental: false,
 			bundlePath: makeLocalBundle(t, *rekorSigner, blobBytes, []byte(blobSignature),
@@ -506,7 +492,6 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with expired certificate - bundle with bad SET",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			cert:         expiredLeafCert,
 			experimental: false,
 			bundlePath: makeLocalBundle(t, *signer, blobBytes, []byte(blobSignature),
@@ -517,7 +502,6 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with expired certificate - experimental good bundle",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			cert:         expiredLeafCert,
 			experimental: true,
 			bundlePath: makeLocalBundle(t, *rekorSigner, blobBytes, []byte(blobSignature),
@@ -528,7 +512,6 @@ func TestVerifyBlob(t *testing.T) {
 			name:         "valid signature with expired certificate - experimental bad rekor entry",
 			blob:         blobBytes,
 			signature:    blobSignature,
-			sigVerifier:  signer,
 			cert:         expiredLeafCert,
 			experimental: true,
 			// This is the wrong signer for the SET!
@@ -540,25 +523,46 @@ func TestVerifyBlob(t *testing.T) {
 	for _, tt := range tts {
 		t.Run(tt.name, func(t *testing.T) {
 			tt := tt
-			var mClient client.Rekor
-			mClient.Entries = &mock.EntriesClient{Entries: tt.rekorEntry}
-			co := &cosign.CheckOpts{
-				SigVerifier: tt.sigVerifier,
-				RootCerts:   rootPool,
-				IgnoreSCT:   true,
+			entries := make([]models.LogEntry, 0)
+			for _, entry := range tt.rekorEntry {
+				entries = append(entries, *entry)
 			}
-			// if expermental is enabled, add RekorClient to co.
-			if tt.experimental {
-				co.RekorClient = &mClient
+			testServer := httptest.NewServer(http.HandlerFunc(
+				func(w http.ResponseWriter, r *http.Request) {
+					w.Header().Set("Content-Type", "application/json")
+					json.NewEncoder(w).Encode(entries)
+				}))
+			defer testServer.Close()
+
+			// Verify command
+			cmd := VerifyBlobCmd{
+				KeyOpts: options.KeyOpts{
+					BundlePath: tt.bundlePath,
+					RekorURL:   testServer.URL},
+				CertEmail:      identity,
+				CertOIDCIssuer: issuer,
+				IgnoreSCT:      true,
+				CertChain:      chainPath,
 			}
-
-			var bundle *bundle.RekorBundle
-			b, err := cosign.FetchLocalSignedPayloadFromPath(tt.bundlePath)
-			if err == nil && b.Bundle != nil {
-				bundle = b.Bundle
+			blobPath := writeBlobFile(t, td, string(blobBytes), "blob.txt")
+			if tt.signature != "" {
+				sigPath := writeBlobFile(t, td, tt.signature, "signature.txt")
+				cmd.SigRef = sigPath
+			}
+			if tt.cert != nil {
+				certPEM, err := cryptoutils.MarshalCertificateToPEM(tt.cert)
+				if err != nil {
+					t.Fatal("MarshalCertificateToPEM: %w", err)
+				}
+				certPath := writeBlobFile(t, td, string(certPEM), "cert.pem")
+				cmd.CertRef = certPath
+			}
+			if tt.key != nil {
+				keyPath := writeBlobFile(t, td, string(tt.key), "key.pem")
+				cmd.KeyRef = keyPath
 			}
 
-			err = verifyBlob(ctx, co, tt.blob, tt.signature, tt.cert, bundle)
+			err := cmd.Exec(context.Background(), blobPath)
 			if (err != nil) != tt.shouldErr {
 				t.Fatalf("verifyBlob()= %s, expected shouldErr=%t ", err, tt.shouldErr)
 			}
@@ -1048,7 +1052,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
 			IgnoreSCT:      true,
 		}
 		err = cmd.Exec(context.Background(), blobPath)
-		if err == nil || !strings.Contains(err.Error(), "verifying certificate from bundle with chain: x509: certificate signed by unknown authority") {
+		if err == nil || !strings.Contains(err.Error(), "x509: certificate signed by unknown authority") {
 			t.Fatalf("expected error with mismatched root, got %v", err)
 		}
 	})
diff --git a/doc/cosign_verify-attestation.md b/doc/cosign_verify-attestation.md
index a07bcade..616c4378 100644
--- a/doc/cosign_verify-attestation.md
+++ b/doc/cosign_verify-attestation.md
@@ -84,7 +84,6 @@ cosign verify-attestation [flags]
       --sk                                                                                       whether to use a hardware security key
       --slot string                                                                              security key slot to use for generated key (default: signature) (authentication|signature|card-authentication|key-management)
       --timestamp-cert-chain string                                                              path to certificate chain PEM file for the Timestamp Authority
-      --timestamp-server-url string                                                              url to a timestamp RFC3161 server, default none
       --type string                                                                              specify a predicate type (slsaprovenance|link|spdx|spdxjson|cyclonedx|vuln|custom) or an URI (default "custom")
 ```
 
diff --git a/pkg/cosign/bundle/tsa_test.go b/pkg/cosign/bundle/tsa_test.go
index f73114fc..a4d81493 100644
--- a/pkg/cosign/bundle/tsa_test.go
+++ b/pkg/cosign/bundle/tsa_test.go
@@ -21,27 +21,27 @@ import (
 	"github.com/go-openapi/strfmt"
 )
 
-func TestTSABundle(t *testing.T) {
+func TestRFC3161Timestamp(t *testing.T) {
 	testCases := []struct {
-		name                  string
-		timestampRFC3161Entry []byte
-		expectedTSABundle     *TSABundle
+		name                     string
+		timestampRFC3161Entry    []byte
+		expectedRFC3161Timestamp *RFC3161Timestamp
 	}{{
-		name:                  "nil timestamp entry",
-		timestampRFC3161Entry: nil,
-		expectedTSABundle:     nil,
+		name:                     "nil timestamp entry",
+		timestampRFC3161Entry:    nil,
+		expectedRFC3161Timestamp: nil,
 	}, {
 		name:                  "timestamp entry",
 		timestampRFC3161Entry: strfmt.Base64([]byte("signature")),
-		expectedTSABundle: &TSABundle{
+		expectedRFC3161Timestamp: &RFC3161Timestamp{
 			SignedRFC3161Timestamp: strfmt.Base64([]byte("signature")),
 		},
 	}}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			gotBundle := TimestampToTSABundle(tc.timestampRFC3161Entry)
-			if !reflect.DeepEqual(gotBundle, tc.expectedTSABundle) {
-				t.Errorf("TimestampToTSABundle returned %v, wanted %v", gotBundle, tc.expectedTSABundle)
+			gotBundle := TimestampToRFC3161Timestamp(tc.timestampRFC3161Entry)
+			if !reflect.DeepEqual(gotBundle, tc.expectedRFC3161Timestamp) {
+				t.Errorf("TimestampToRFC3161Timestamp returned %v, wanted %v", gotBundle, tc.expectedRFC3161Timestamp)
 			}
 		})
 	}
diff --git a/pkg/cosign/verify_test.go b/pkg/cosign/verify_test.go
index 654d5618..0843256f 100644
--- a/pkg/cosign/verify_test.go
+++ b/pkg/cosign/verify_test.go
@@ -462,7 +462,6 @@ func TestVerifyImageSignatureWithSigVerifierAndTSA(t *testing.T) {
 	}
 	if bundleVerified, err := VerifyImageSignature(context.TODO(), sig, v1.Hash{}, &CheckOpts{
 		SigVerifier:    sv,
-		TSAClient:      client,
 		TSACerts:       tsaCertPool,
 		SkipTlogVerify: true,
 	}); err != nil || !bundleVerified {
@@ -514,7 +513,6 @@ func TestVerifyImageSignatureWithSigVerifierAndRekorTSA(t *testing.T) {
 	}
 	if _, err := VerifyImageSignature(context.TODO(), sig, v1.Hash{}, &CheckOpts{
 		SigVerifier: sv,
-		TSAClient:   client,
 		TSACerts:    tsaCertPool,
 		RekorClient: mClient,
 	}); err == nil || !strings.Contains(err.Error(), "verifying inclusion proof") {
diff --git a/pkg/oci/internal/signature/layer_test.go b/pkg/oci/internal/signature/layer_test.go
index 8721b5c7..52d9366c 100644
--- a/pkg/oci/internal/signature/layer_test.go
+++ b/pkg/oci/internal/signature/layer_test.go
@@ -299,7 +299,7 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 		wantCertErr    error
 		wantChain      int
 		wantChainErr   error
-		wantBundle     *bundle.TSABundle
+		wantBundle     *bundle.RFC3161Timestamp
 		wantBundleErr  error
 	}{{
 		name: "just payload and signature",
@@ -320,10 +320,10 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 			desc: v1.Descriptor{
 				Digest: digest,
 				Annotations: map[string]string{
-					sigkey:       "blah",
-					certkey:      "",
-					chainkey:     "",
-					TSABundleKey: "",
+					sigkey:              "blah",
+					certkey:             "",
+					chainkey:            "",
+					RFC3161TimestampKey: "",
 				},
 			},
 		},
@@ -344,13 +344,13 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 			desc: v1.Descriptor{
 				Digest: digest,
 				Annotations: map[string]string{
-					sigkey:       "blah",
-					TSABundleKey: `}`,
+					sigkey:              "blah",
+					RFC3161TimestampKey: `}`,
 				},
 			},
 		},
 		wantSig:       "blah",
-		wantBundleErr: errors.New(`unmarshaling tsa bundle: invalid character '}' looking for beginning of value`),
+		wantBundleErr: errors.New(`unmarshaling RFC3161 timestamp bundle: invalid character '}' looking for beginning of value`),
 	}, {
 		name: "min plus bad cert",
 		l: &sigLayer{
@@ -380,7 +380,7 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 		wantSig:      "blah",
 		wantChainErr: errors.New(`error during PEM decoding`),
 	}, {
-		name: "min plus TSA bundle",
+		name: "min plus RFC3161 timestamp bundle",
 		l: &sigLayer{
 			Layer: layer,
 			desc: v1.Descriptor{
@@ -389,12 +389,12 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 					sigkey: "TSA blah",
 					// This was extracted from gcr.io/distroless/static:nonroot on 2021/09/16.
 					// The Body has been removed for brevity
-					TSABundleKey: `{"SignedRFC3161Timestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="}`,
+					RFC3161TimestampKey: `{"SignedRFC3161Timestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="}`,
 				},
 			},
 		},
 		wantSig: "TSA blah",
-		wantBundle: &bundle.TSABundle{
+		wantBundle: &bundle.RFC3161Timestamp{
 			SignedRFC3161Timestamp: mustDecode("MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="),
 		},
 	}}
@@ -442,13 +442,13 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 				t.Errorf("Chain() = %v, wanted chain of length %d", got, test.wantChain)
 			}
 
-			switch got, err := test.l.TSABundle(); {
+			switch got, err := test.l.RFC3161Timestamp(); {
 			case (err != nil) != (test.wantBundleErr != nil):
-				t.Errorf("TSABundle() = %v, wanted %v", err, test.wantBundleErr)
+				t.Errorf("RFC3161Timestamp() = %v, wanted %v", err, test.wantBundleErr)
 			case (err != nil) && (test.wantBundleErr != nil) && err.Error() != test.wantBundleErr.Error():
-				t.Errorf("TSABundle() = %v, wanted %v", err, test.wantBundleErr)
+				t.Errorf("RFC3161Timestamp() = %v, wanted %v", err, test.wantBundleErr)
 			case !cmp.Equal(got, test.wantBundle):
-				t.Errorf("TSABundle() %s", cmp.Diff(got, test.wantBundle))
+				t.Errorf("RFC3161Timestamp() %s", cmp.Diff(got, test.wantBundle))
 			}
 		})
 	}
diff --git a/pkg/oci/mutate/signature_test.go b/pkg/oci/mutate/signature_test.go
index 6d7ab5f8..80c9a695 100644
--- a/pkg/oci/mutate/signature_test.go
+++ b/pkg/oci/mutate/signature_test.go
@@ -128,18 +128,18 @@ func assertSignaturesEqual(t *testing.T, wanted, got oci.Signature) {
 		}
 	})
 
-	t.Run("TSA Bundles match", func(t *testing.T) {
+	t.Run("RFC3161 timestamp bundles match", func(t *testing.T) {
 		t.Helper()
-		wantedBundle, err := wanted.TSABundle()
+		wantedBundle, err := wanted.RFC3161Timestamp()
 		if err != nil {
 			t.Fatalf("wanted.Bundle() returned error: %v", err)
 		}
-		gotBundle, err := got.TSABundle()
+		gotBundle, err := got.RFC3161Timestamp()
 		if err != nil {
-			t.Fatalf("got.TSABundle() returned error: %v", err)
+			t.Fatalf("got.RFC3161Timestamp() returned error: %v", err)
 		}
 		if diff := cmp.Diff(wantedBundle, gotBundle); diff != "" {
-			t.Errorf("TSABundle() mismatch (-want +got):\n%s", diff)
+			t.Errorf("RFC3161Timestamp() mismatch (-want +got):\n%s", diff)
 		}
 	})
 
@@ -326,18 +326,18 @@ func TestSignatureWithBundle(t *testing.T) {
 	assertSignaturesEqual(t, expectedSig, newSig)
 }
 
-func TestSignatureWithTSABundle(t *testing.T) {
+func TestSignatureWithRFC3161Timestamp(t *testing.T) {
 	payload := "this is the TestSignatureWithBundle content!"
 	b64sig := "b64 content2="
-	b := &bundle.TSABundle{
+	b := &bundle.RFC3161Timestamp{
 		SignedRFC3161Timestamp: mustBase64Decode(t, "MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="),
 	}
 	originalSig := mustCreateSignature(t, []byte(payload), b64sig)
-	expectedSig := mustCreateSignature(t, []byte(payload), b64sig, static.WithTSABundle(b))
+	expectedSig := mustCreateSignature(t, []byte(payload), b64sig, static.WithRFC3161Timestamp(b))
 
-	newSig, err := Signature(originalSig, WithTSABundle(b))
+	newSig, err := Signature(originalSig, WithRFC3161Timestamp(b))
 	if err != nil {
-		t.Fatalf("Signature(WithTSABundle()) returned error: %v", err)
+		t.Fatalf("Signature(WithRFC3161Timestamp()) returned error: %v", err)
 	}
 
 	assertSignaturesEqual(t, expectedSig, newSig)
@@ -420,7 +420,7 @@ func TestSignatureWithEverythingTSA(t *testing.T) {
 		"foo":  "bar",
 		"test": "yes",
 	}
-	b := &bundle.TSABundle{
+	b := &bundle.RFC3161Timestamp{
 		SignedRFC3161Timestamp: mustBase64Decode(t, "MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="),
 	}
 	mediaType := types.MediaType("test/media.type")
@@ -429,13 +429,13 @@ func TestSignatureWithEverythingTSA(t *testing.T) {
 
 	expectedSig := mustCreateSignature(t, []byte(payload), b64sig,
 		static.WithAnnotations(annotations),
-		static.WithTSABundle(b),
+		static.WithRFC3161Timestamp(b),
 		static.WithCertChain(testCertBytes, testChainBytes),
 		static.WithLayerMediaType(mediaType))
 
 	newSig, err := Signature(originalSig,
 		WithAnnotations(annotations),
-		WithTSABundle(b),
+		WithRFC3161Timestamp(b),
 		WithCertChain(testCertBytes, testChainBytes),
 		WithMediaType(mediaType))
 
diff --git a/pkg/oci/signature/layer_test.go b/pkg/oci/signature/layer_test.go
index 1801b363..c28b19cf 100644
--- a/pkg/oci/signature/layer_test.go
+++ b/pkg/oci/signature/layer_test.go
@@ -299,7 +299,7 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 		wantCertErr    error
 		wantChain      int
 		wantChainErr   error
-		wantBundle     *bundle.TSABundle
+		wantBundle     *bundle.RFC3161Timestamp
 		wantBundleErr  error
 	}{{
 		name: "just payload and signature",
@@ -320,10 +320,10 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 			desc: v1.Descriptor{
 				Digest: digest,
 				Annotations: map[string]string{
-					sigkey:       "blah",
-					certkey:      "",
-					chainkey:     "",
-					TSABundleKey: "",
+					sigkey:              "blah",
+					certkey:             "",
+					chainkey:            "",
+					RFC3161TimestampKey: "",
 				},
 			},
 		},
@@ -338,19 +338,19 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 		},
 		wantSigErr: fmt.Errorf("signature layer %s is missing %q annotation", digest, sigkey),
 	}, {
-		name: "min plus bad TSA bundle",
+		name: "min plus bad RFC3161 timestamp bundle",
 		l: &sigLayer{
 			Layer: layer,
 			desc: v1.Descriptor{
 				Digest: digest,
 				Annotations: map[string]string{
-					sigkey:       "blah",
-					TSABundleKey: `}`,
+					sigkey:              "blah",
+					RFC3161TimestampKey: `}`,
 				},
 			},
 		},
 		wantSig:       "blah",
-		wantBundleErr: errors.New(`unmarshaling tsa bundle: invalid character '}' looking for beginning of value`),
+		wantBundleErr: errors.New(`unmarshaling RFC3161 timestamp bundle: invalid character '}' looking for beginning of value`),
 	}, {
 		name: "min plus bad cert",
 		l: &sigLayer{
@@ -380,7 +380,7 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 		wantSig:      "blah",
 		wantChainErr: errors.New(`error during PEM decoding`),
 	}, {
-		name: "min plus TSA bundle",
+		name: "min plus RFC3161 timestamp bundle",
 		l: &sigLayer{
 			Layer: layer,
 			desc: v1.Descriptor{
@@ -389,12 +389,12 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 					sigkey: "tsa blah",
 					// This was extracted from gcr.io/distroless/static:nonroot on 2021/09/16.
 					// The Body has been removed for brevity
-					TSABundleKey: `{"SignedRFC3161Timestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE=","Payload":{"body":"REMOVED","integratedTime":1631646761,"logIndex":693591,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"}}`,
+					RFC3161TimestampKey: `{"SignedRFC3161Timestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE=","Payload":{"body":"REMOVED","integratedTime":1631646761,"logIndex":693591,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"}}`,
 				},
 			},
 		},
 		wantSig: "tsa blah",
-		wantBundle: &bundle.TSABundle{
+		wantBundle: &bundle.RFC3161Timestamp{
 			SignedRFC3161Timestamp: mustDecode("MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="),
 		},
 	}}
@@ -442,13 +442,13 @@ func TestSignatureWithTSAAnnotation(t *testing.T) {
 				t.Errorf("Chain() = %v, wanted chain of length %d", got, test.wantChain)
 			}
 
-			switch got, err := test.l.TSABundle(); {
+			switch got, err := test.l.RFC3161Timestamp(); {
 			case (err != nil) != (test.wantBundleErr != nil):
-				t.Errorf("TSABundle() = %v, wanted %v", err, test.wantBundleErr)
+				t.Errorf("RFC3161Timestamp() = %v, wanted %v", err, test.wantBundleErr)
 			case (err != nil) && (test.wantBundleErr != nil) && err.Error() != test.wantBundleErr.Error():
-				t.Errorf("TSABundle() = %v, wanted %v", err, test.wantBundleErr)
+				t.Errorf("RFC3161Timestamp() = %v, wanted %v", err, test.wantBundleErr)
 			case !cmp.Equal(got, test.wantBundle):
-				t.Errorf("TSABundle() %s", cmp.Diff(got, test.wantBundle))
+				t.Errorf("RFC3161Timestamp() %s", cmp.Diff(got, test.wantBundle))
 			}
 		})
 	}
diff --git a/pkg/oci/static/options_test.go b/pkg/oci/static/options_test.go
index d67a829e..eb7ef2c9 100644
--- a/pkg/oci/static/options_test.go
+++ b/pkg/oci/static/options_test.go
@@ -27,7 +27,7 @@ import (
 
 func TestOptions(t *testing.T) {
 	bundle := &cbundle.RekorBundle{}
-	tsaBundle := &cbundle.TSABundle{}
+	rfc3161Timestamp := &cbundle.RFC3161Timestamp{}
 
 	tests := []struct {
 		name string
@@ -93,28 +93,28 @@ func TestOptions(t *testing.T) {
 			Bundle: bundle,
 		},
 	}, {
-		name: "with TSA bundle",
-		opts: []Option{WithTSABundle(tsaBundle)},
+		name: "with RFC3161 timestamp bundle",
+		opts: []Option{WithRFC3161Timestamp(rfc3161Timestamp)},
 		want: &options{
 			LayerMediaType:  ctypes.SimpleSigningMediaType,
 			ConfigMediaType: types.OCIConfigJSON,
 			Annotations: map[string]string{
-				TSABundleAnnotationKey: "{\"SignedRFC3161Timestamp\":null}",
+				RFC3161TimestampAnnotationKey: "{\"SignedRFC3161Timestamp\":null}",
 			},
-			TSABundle: tsaBundle,
+			RFC3161Timestamp: rfc3161Timestamp,
 		},
 	}, {
 		name: "with TSA and Rekor bundle",
-		opts: []Option{WithTSABundle(tsaBundle), WithBundle(bundle)},
+		opts: []Option{WithRFC3161Timestamp(rfc3161Timestamp), WithBundle(bundle)},
 		want: &options{
 			LayerMediaType:  ctypes.SimpleSigningMediaType,
 			ConfigMediaType: types.OCIConfigJSON,
 			Annotations: map[string]string{
-				TSABundleAnnotationKey: "{\"SignedRFC3161Timestamp\":null}",
-				BundleAnnotationKey:    "{\"SignedEntryTimestamp\":null,\"Payload\":{\"body\":null,\"integratedTime\":0,\"logIndex\":0,\"logID\":\"\"}}",
+				RFC3161TimestampAnnotationKey: "{\"SignedRFC3161Timestamp\":null}",
+				BundleAnnotationKey:           "{\"SignedEntryTimestamp\":null,\"Payload\":{\"body\":null,\"integratedTime\":0,\"logIndex\":0,\"logID\":\"\"}}",
 			},
-			TSABundle: tsaBundle,
-			Bundle:    bundle,
+			RFC3161Timestamp: rfc3161Timestamp,
+			Bundle:           bundle,
 		},
 	}}
 
diff --git a/pkg/oci/static/signature_test.go b/pkg/oci/static/signature_test.go
index a507334f..b347ac74 100644
--- a/pkg/oci/static/signature_test.go
+++ b/pkg/oci/static/signature_test.go
@@ -447,7 +447,7 @@ Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==
 	})
 }
 
-func TestNewSignatureCertChainAndRekorTSABundle(t *testing.T) {
+func TestNewSignatureCertChainAndRekorRFC3161Timestamp(t *testing.T) {
 	payload := "this is the other content!"
 	b64sig := "b64 content="
 
@@ -486,7 +486,7 @@ Ve/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uup
 Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==
 -----END CERTIFICATE-----
 `)
-		b = &bundle.TSABundle{
+		b = &bundle.RFC3161Timestamp{
 			SignedRFC3161Timestamp: mustDecode("MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="),
 		}
 		rekorBundle = &bundle.RekorBundle{
@@ -501,7 +501,7 @@ Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==
 	)
 
 	l, err := NewSignature([]byte(payload), b64sig,
-		WithCertChain(cert, chain), WithTSABundle(b))
+		WithCertChain(cert, chain), WithRFC3161Timestamp(b))
 	if err != nil {
 		t.Fatalf("NewSignature() = %v", err)
 	}
@@ -523,10 +523,10 @@ Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==
 			t.Errorf("Base64Signature() = %s, wanted %s", got, want)
 		}
 
-		if got, err := l.TSABundle(); err != nil {
-			t.Fatalf("TSABundle() = %v", err)
+		if got, err := l.RFC3161Timestamp(); err != nil {
+			t.Fatalf("RFC3161Timestamp() = %v", err)
 		} else if got != b {
-			t.Errorf("TSABundle() = %#v, wanted %#v", got, b)
+			t.Errorf("RFC3161Timestamp() = %#v, wanted %#v", got, b)
 		}
 
 		if got, err := l.Cert(); err != nil {
@@ -548,7 +548,7 @@ Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==
 			CertificateAnnotationKey: string(cert),
 			ChainAnnotationKey:       string(chain),
 
-			TSABundleAnnotationKey: `{"SignedRFC3161Timestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="}`,
+			RFC3161TimestampAnnotationKey: `{"SignedRFC3161Timestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="}`,
 		}
 		got, err := l.Annotations()
 		if err != nil {
@@ -560,7 +560,7 @@ Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==
 	})
 
 	newSig, err := NewSignature([]byte(payload), b64sig,
-		WithCertChain(cert, chain), WithTSABundle(b), WithBundle(rekorBundle))
+		WithCertChain(cert, chain), WithRFC3161Timestamp(b), WithBundle(rekorBundle))
 	if err != nil {
 		t.Fatalf("NewSignature() = %v", err)
 	}
@@ -588,10 +588,10 @@ Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==
 			t.Errorf("Bundle() = %#v, wanted %#v", got, b)
 		}
 
-		if got, err := newSig.TSABundle(); err != nil {
-			t.Fatalf("TSABundle() = %v", err)
+		if got, err := newSig.RFC3161Timestamp(); err != nil {
+			t.Fatalf("RFC3161Timestamp() = %v", err)
 		} else if got != b {
-			t.Errorf("TSABundle() = %#v, wanted %#v", got, b)
+			t.Errorf("RFC3161Timestamp() = %#v, wanted %#v", got, b)
 		}
 
 		if got, err := newSig.Cert(); err != nil {
@@ -613,8 +613,8 @@ Hr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==
 			CertificateAnnotationKey: string(cert),
 			ChainAnnotationKey:       string(chain),
 
-			TSABundleAnnotationKey: `{"SignedRFC3161Timestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="}`,
-			BundleAnnotationKey:    `{"SignedEntryTimestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE=","Payload":{"body":"REMOVED","integratedTime":1631646761,"logIndex":693591,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"}}`,
+			RFC3161TimestampAnnotationKey: `{"SignedRFC3161Timestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE="}`,
+			BundleAnnotationKey:           `{"SignedEntryTimestamp":"MEUCIQClUkUqZNf+6dxBc/pxq22JIluTB7Kmip1G0FIF5E0C1wIgLqXm+IM3JYW/P/qjMZSXW+J8bt5EOqNfe3R+0A9ooFE=","Payload":{"body":"REMOVED","integratedTime":1631646761,"logIndex":693591,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"}}`,
 		}
 		got, err := newSig.Annotations()
 		if err != nil {
diff --git a/pkg/policy/attestation_test.go b/pkg/policy/attestation_test.go
index d7c69b94..ceab2b53 100644
--- a/pkg/policy/attestation_test.go
+++ b/pkg/policy/attestation_test.go
@@ -55,7 +55,7 @@ func (fa *failingAttestation) Chain() ([]*x509.Certificate, error) {
 func (fa *failingAttestation) Bundle() (*bundle.RekorBundle, error) {
 	return nil, fmt.Errorf("unimplemented")
 }
-func (fa *failingAttestation) TSABundle() (*bundle.TSABundle, error) {
+func (fa *failingAttestation) RFC3161Timestamp() (*bundle.RFC3161Timestamp, error) {
 	return nil, fmt.Errorf("unimplemented")
 }
 func (fa *failingAttestation) Digest() (v1.Hash, error) {
diff --git a/test/e2e_test.go b/test/e2e_test.go
index 30987b55..6fa5491d 100644
--- a/test/e2e_test.go
+++ b/test/e2e_test.go
@@ -528,7 +528,7 @@ func TestRekorBundle(t *testing.T) {
 	must(verify(pubKeyPath, imgName, true, nil, ""), t)
 }
 
-func TestTSABundle(t *testing.T) {
+func TestRFC3161Timestamp(t *testing.T) {
 	// turn on the tlog
 	defer setenv(t, env.VariableExperimental.String(), "1")()
 	// TODO: Replace with a full TSA mock client, related to https://github.com/sigstore/timestamp-authority/issues/146
@@ -584,7 +584,7 @@ func TestTSABundle(t *testing.T) {
 	must(verifyTSA(pubKeyPath, imgName, true, nil, "", server.URL, file.Name(), true), t)
 }
 
-func TestRekorBundleAndTSABundle(t *testing.T) {
+func TestRekorBundleAndRFC3161Timestamp(t *testing.T) {
 	// turn on the tlog
 	defer setenv(t, env.VariableExperimental.String(), "1")()
 	// TODO: Replace with a full TSA mock client, related to https://github.com/sigstore/timestamp-authority/issues/146