Make gpg signature creation subpacket mandatory
Make gpg signature creation subpacket mandatory

Following a review comment by @SantiagoTorres, this commit modifies
in_toto.gpg.common to explicitly parse the signature creation time
subpacket in the signature parsing function, instead of
`_assign_certified_key_info` where it is used, and raise
ValueError if it is not present, instead of just ignoring it.

As a consequence `_assign_certified_key_info` does not have to
test and case handle if the subpacket is not there. However,
`_assign_certified_key_info` will still skip signatures with
missing creation time subpacket, because it skips
all un-parseable signatures.

This commit also updates a TODO comment that refers to an upcoming
revision of the exception taxonomy.

secure-systems-lab/securesystemslib,secure-systems-lab/securesystemslib