pub fn parse_flag(value: &str) -> Result<(String, String), String>
--trust-hook name=sha256:…, split.
--trust-hook name=sha256:…
The value is not name=digest.
name=digest