Think about a way to better trust VEX Golden Data

[puerco]

Currently, to attest VEX data in an image, we point vexctl to a file containing the known VEX info for a project.

We should think of a way to trust the VEX data file and also record somewhere from which file the vex attestation or file was built.