Sigstore's Cosign CLI tool should expose flags to override root TUF endpoints set when initialised. We're all for cleaner commands !