Signature: Lint fixes

Signed-off-by: Olle E. Johansson <[email protected]>

Author: oej

signatures/signature.md

@@ -8,15 +8,14 @@ signature files.
 
 - __Integrity__: Documents dowloaded needs to be the same
   as documents published
-- __Identity__: 
-  - Customers needs to be able to verify the 
+- __Identity__:
+  - Customers need to be able to verify the
   publisher of the documents and verify that it is
   the expected publisher.
   - A TEA server may want to verify that published
   documents are signed by the expected publisher
   and that signatures are valid.
 
-
 In order to sign, a pair of asymmetric keys will be needed.
 The public key is used to create a certificate, signed
 by a certificate authority (CA).
@@ -27,7 +26,7 @@ parties do not automatically trust that internal PKI.
 
 This document outlines a proposal on how to build that trust and
 make it possible for publishers to use an internal PKI. It is
-of course important that this PKI is maintained according to 
+of course important that this PKI is maintained according to
 best current practise.
 
 ## API trust
@@ -59,13 +58,13 @@ that would cause a chicken-and-egg problem.
 ## Digital signatures
 
 ### Digital signatures as specified for CycloneDX
+
 "Digital signatures may be applied to a BOM or to an assembly within a BOM.
 CycloneDX supports XML Signature, JSON Web Signature (JWS), and JSON Signature Format (JSF).
 Signed BOMs benefit by providing advanced integrity and non-repudiation capabilities."
-https://cyclonedx.org/use-cases/#authenticity
-
+<https://cyclonedx.org/use-cases/#authenticity>
 
-### External (deattached) digital signatures for other documents
+### External (detached) digital signatures for other documents
 
 - indication of hash algorithm
 - indicator of cert used
@@ -76,7 +75,7 @@ https://cyclonedx.org/use-cases/#authenticity
 ## Using Sigstore for signing
 
 Sigstore is an excellent free service for both signing of GIT commits as well
-as artefacts by using ephemeral certificates (very shortlived) and a 
+as artefacts by using ephemeral certificates (very shortlived) and a
 certificate transparency log for validation and verification.
 Sigstore signatures contain timestamps from a timestamping service.
 
@@ -96,13 +95,11 @@ Sigstore signatures contain timestamps from a timestamping service.
 
 ### DNS entry
 
-
-
 ## References
 
 - IETF RFC DANE
 - IETF DANCE architecture (IETF draft)
 - IETF Digital signature
-- JSON web signatures (JWS) - https://datatracker.ietf.org/doc/html/rfc7515
-- JSON signature format (JSF) - https://cyberphone.github.io/doc/security/jsf.html
+- JSON web signatures (JWS) - <https://datatracker.ietf.org/doc/html/rfc7515>
+- JSON signature format (JSF) - <https://cyberphone.github.io/doc/security/jsf.html>
 - [IETF Enrollment over Secure Transport (EST) RFC 7030](https://www.rfc-editor.org/rfc/rfc7030)