A few implementation notes:

• We likely can support both TUF clients concurrently without a flag. We may be able to use the same cache folder too, needs confirmation.
• We'll need to modify how the individual service targets are fetched, as the API differs between the previous and new sigstore TUF clients
• We should update the e2e tests to generate the trusted root file and serve a local TUF repository
• To test, we simply need to initialize against the production TUF repo, which is currently distributing a trusted root file

Another implementation note, as per sigstore/sigstore-go#38, we can now initialize multiple clients for different repositories each with its own local cache, which covers the use case of verifying against multiple trusted roots (eg the public instance + a private instance). We can add this around the same time.