From #46: these outputs are now redundant against .sigstore, but are included by default for backwards compatibility.

As such, we should add a setting (maybe bundle-only: bool or similar?) that allows a user to disable them if they don't need them and don't want them cluttering up their releases.