code: func matchReleasedSignatures(allTargets []client.TargetSignedStruct) []trustTagRow {
  	signatureRows := []trustTagRow{}
  	// do a first pass to get filter on tags signed into "targets" or "targets/releases"
  	releasedTargetRows := map[trustTagKey][]string{}
  	for _, tgt := range allTargets {
  		if isReleasedTarget(tgt.Role.Name) {
  			releasedKey := trustTagKey{tgt.Target.Name, hex.EncodeToString(tgt.Target.Hashes[notary.SHA256])}
  			releasedTargetRows[releasedKey] = []string{}
  		}
  	}
  
  	// now fill out all signers on released keys
  	for _, tgt := range allTargets {
  		targetKey := trustTagKey{tgt.Target.Name, hex.EncodeToString(tgt.Target.Hashes[notary.SHA256])}
  		// only considered released targets
  		if _, ok := releasedTargetRows[targetKey]; ok && !isReleasedTarget(tgt.Role.Name) {
  			releasedTargetRows[targetKey] = append(releasedTargetRows[targetKey], notaryRoleToSigner(tgt.Role.Name))
  		}
  	}
  
  	// compile the final output as a sorted slice
  	for targetKey, signers := range releasedTargetRows {
  		signatureRows = append(signatureRows, trustTagRow{targetKey, signers})
  	}
  	sort.Slice(signatureRows, func(i, j int) bool {
  		return sortorder.NaturalLess(signatureRows[i].SignedTag, signatureRows[j].SignedTag)
  	})
  	return signatureRows
  }
docs: // aggregate all signers for a "released" hash+tagname pair. To be "released," the tag must have been
  // signed into the "targets" or "targets/releases" role. Output is sorted by tag name