cosign installer removes cosign.pub from the root of project causing dirty state for goreleaser

[dopey]

Description

This is my cosign installer block:

      -
        name: Install cosign
        uses: sigstore/cosign-installer@main
        with:
          cosign-release: 'v1.1.0'

After it runs, my git state is dirty and goreleaser fails with the following error:

 ⨯ release failed after 0.02s error=git is currently in a dirty state, please check in your pipeline what can be changing the following files:
 D cosign.pub

I've placed a tmate debug before the action and then after to confirm that something in this action is dirtying the state.

[dopey]

I'm guessing it's this commit #22.