enable automated rotation of TSA certificates

[dmitris]

Description

The certificates that are used for the web server connection are not rotated - which leads to the server refusing the connection once the certificates expire (especially if the certificates have short expiration timeframe - which is advisable for better security). Need to add something like fswatch to notice when the certificate has changed and reload it.

[haydentherapper]

We have something like this in Fulcio for the file-based CA, for the signing certificate - https://github.com/sigstore/fulcio/blob/main/pkg/ca/fileca/fileca.go#L34

I would advise against this though. It requires adding locks throughout the codebase. I would expect that rotating a certificate during an active connection may cause unexpected failures.

Can this be handled by the orchestration framework, restarting the server with the updated certificate?