SPIFFE / SPIRE workload identity

A standard (SPIFFE) and runtime (SPIRE) that issue cryptographic workload identities (SVIDs) via node/workload attestation; SPIRE can act as a service mesh's certificate authority (e.g. for Istio via Envoy SDS).