review: Also exclude trusted intermediate certs

Signed-off-by: Aditya Sirish <[email protected]>
Co-authored-by: Appu Goundan <[email protected]>

protos/sigstore_bundle.proto

@@ -72,7 +72,8 @@ message VerificationMaterial {
 // meant to be used for the `ext` field in a signature extension. The `kind` for
 // the Sigstore DSSE extension MUST be
 // application/vnd.dev.sigstore.dsse+json;version=0.1. The certificate chain
-// included MUST NOT include the Sigstore root certificate.
+// included MUST NOT include the Sigstore root or trusted intermediate
+// certificates.
 message DSSESignatureExtension {
         dev.sigstore.common.v1.X509CertificateChain x509_certificate_chain = 1 [(google.api.field_behavior) = REQUIRED];