diff --git a/pkg/client/client.go b/pkg/client/client.go
index 4093884..917999d 100644
--- a/pkg/client/client.go
+++ b/pkg/client/client.go
@@ -40,7 +40,7 @@ func (s *SecureClient) Verify() (*EnclaveState, error) {
 		return nil, fmt.Errorf("failed to fetch attestation bundle: %v", err)
 	}
 
-	codeMeasurements, err := sigstore.VerifyAttestation(sigstoreBundle, eifHash, s.repo)
+	codeMeasurements, err := sigstore.VerifyAttestation(sigstoreBundle, eifHash, s.repo, nil)
 	if err != nil {
 		return nil, fmt.Errorf("failed to verify attested measurements: %v", err)
 	}
diff --git a/pkg/sigstore/sigstore.go b/pkg/sigstore/sigstore.go
index 0c87dfa..c26ce13 100644
--- a/pkg/sigstore/sigstore.go
+++ b/pkg/sigstore/sigstore.go
@@ -19,8 +19,8 @@ const (
 	oidcIssuer = "https://token.actions.githubusercontent.com"
 )
 
-// fetchTrustRoot fetches the trust root from the Sigstore TUF repo
-func fetchTrustRoot() (*root.TrustedRoot, error) {
+// FetchTrustRoot fetches the trust root from the Sigstore TUF repo
+func FetchTrustRoot() ([]byte, error) {
 	tufOpts := tuf.
 		DefaultOptions().
 		WithDisableLocalCache().
@@ -30,12 +30,7 @@ func fetchTrustRoot() (*root.TrustedRoot, error) {
 		return nil, err
 	}
 
-	trustRootJSON, err := client.GetTarget("trusted_root.json")
-	if err != nil {
-		return nil, fmt.Errorf("failed to get trusted_root.json: %w", err)
-	}
-
-	return root.NewTrustedRootFromJSON(trustRootJSON)
+	return client.GetTarget("trusted_root.json")
 }
 
 // VerifyAttestation verifies the attested measurements of an enclave image
@@ -43,10 +38,19 @@ func fetchTrustRoot() (*root.TrustedRoot, error) {
 func VerifyAttestation(
 	bundleJSON []byte,
 	hexDigest, repo string,
+	trustRootJSON []byte,
 ) (*attestation.Measurement, error) {
-	trustRoot, err := fetchTrustRoot()
+	if trustRootJSON == nil {
+		var err error
+		trustRootJSON, err = FetchTrustRoot()
+		if err != nil {
+			return nil, fmt.Errorf("fetching trust root: %w", err)
+		}
+	}
+
+	trustRoot, err := root.NewTrustedRootFromJSON(trustRootJSON)
 	if err != nil {
-		return nil, fmt.Errorf("fetching trust root: %w", err)
+		return nil, fmt.Errorf("parsing trust root: %w", err)
 	}
 
 	var b bundle.Bundle