There are a number of things we can do here to make these APIs more ergonomic:

1. Remove all API-level foreign type dependencies: Attestation.verify should construct the sigstore types it needs internally, rather than having those foreign types passed in. remove Verifier param from verify() API #62
2. Make Attestation.verify() take a Publisher instead of a VerificationPolicy, since the former can be transformed into the latter.
3. Add some kind of Provenance.verify() API -- this needs a little more design thought.