-- unfortunately, I made a mistake: I packaged version 3 of jellydator-ttlcache, which has a significantly different API than version2, which sigstore currently uses.
I'm considering either downgrading the package, or making sigstore use v3. I guess the latter is better in the long term. Mh.