look into tuf

[dvc94ch]

looks like some of the problems that signed streams have compared to content addressed streams are dealt with in the update framework.

[dvc94ch]

so the main takeaway from tuf is that we can simplify key rotation by having an offline key that is signs an online key. also if we do sparse streams or update in place streams we would need to version the signed heads. Currently we can tell which is more recent by comparing the offsets.