Release v0.29.0

[MVrachev]

Description of issue or feature request:
A new version of securesystemslib was released 4 months ago on 18-th of April.
There are many changes from then up to today:
v0.28.0...main

Is there anything that stops the release @jku @lukpueh?

I will help the maintainers by submitting a possible CHANGELOG as suggested by @jku.

securesystemslib v0.29.0

Added

• Add SigstoreKey and SigstoreSigner signer: add basic sigstore signer and verifier #522.
• Add SpxKey and SpxSigner signer: move spx keygen, sign and verify API #568.
• Add AzureSigner Add Azure Signer support #588.
• Add AWS KMS Signer feat: Adds AWS KMS signing. #609.
• Add CryptoSigner as a replacement for SSLibSigner. Add replacement API for '*keys' and 'interface' key generation and import  #604

Changed

• Moved spx keygen to securesystemslib/signer/_spx_signer.py signer: move spx keygen, sign and verify API #568
• Use sigstore v. 1.1.2 SigstoreSigner: Use sigstore 1.1.2 #583
• Move signature verification for "securesystemslib keys" inside SSlibKey. key: refactor SSlibKey.verify_signature  #585

Removed

• Support for spx keygen. signer: move spx keygen, sign and verify API #568.

Depricated

• SSlibSigner and sslib keydict Add replacement API for '*keys' and 'interface' key generation and import  #604

Fixed

• Fix CI permission error signer: adopt upstream sigstore API change #578

[jku]

release is a good idea.

potential blockers:

• docs: rewrite README #624, Automate Signer API docs for RTD #622
• Adapt to new sigstore api #630 -- we should not treat this as hard blocker as the sigstore release has not happened but recent commits look like release activity :) and I'd really like to have decent sigstore support
• anything else?

[jku]

Add SpxKey and SpxSigner #568

Hmm, the signer is not enabled by default but it's also not documented as unstable or experimental... I think it probably should: I'm thinking mostly about the key and signature container formats: they really should be documented in a TAP or something and I don't think they are currently

[jku]

I've made #632 to address the stability status

[MVrachev]

I approved it, but I am not a maintainer :D

[jku]

current blocker list

• Automate Signer API docs for RTD #622
• docs: rewrite README - continuation #634
• Sigstore, Spx: Add notes about metadata format stability #632
• Adapt to new sigstore api #630 (soft block only: let's not block if sigstore has not released)