Fixed
ggshield plugin install --allow-unsignedandggshield plugin update --allow-unsignednow verify plugin signatures using the embedded / cached sigstore trust root instead of refreshing it over the network, so plugins can still be installed when the sigstore TUF endpoints are unreachable.