git-repo: add tuf-client-like security features to both signer and repo

[jku]

Example: if the repository is compromised and the whole metadata is replaced with something not signed by correct keys, the signer should refuse to operate (because it keeps a client-like metadata cache and the "update" from cached state fails). This could even be implemented as a fairly normal TUF client (just one that fetches metadata from the git tree)