SigningConfig has some complexity now in how services should be selected: https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_trustroot.proto#L180

Should add tests to cover more cases (multiple versions, multliple services, different ServiceConfigs)

followup from #1407