cosign: Local Cert verify not working for Azure KMS

Description

Using cosign with Azure KMS results in different behavior for validation with KMS and local pub cert.

cosign verify -key azurekms://keyvault-xyz.vault.azure.net/cosign registryXYZ.azurecr.io/example-func:1.0.0
using embedded fulcio certificate. did you run `cosign init`? error retrieving target:  missing target metadata: tuf: no root keys found in local meta store

Verification for registryXYZ.azurecr.io/example-func:1.0.0 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
  - Any certificates were verified against the Fulcio roots.

[{"critical":{"identity":{"docker-reference":"registryXYZ.azurecr.io/example-func"},"image":{"docker-manifest-digest":"sha256:e231349fdf394a570e0cb84fe5109bc6980f52b84dd219fcae9922922a715d7d"},"type":"cosign container image signature"},"optional":{"tag":"1.0.0"}},{"critical":{"identity":{"docker-reference":"registryXYZ.azurecr.io/example-func"},"image":{"docker-manifest-digest":"sha256:e231349fdf394a570e0cb84fe5109bc6980f52b84dd219fcae9922922a715d7d"},"type":"cosign container image signature"},"optional":null}]

But when I use the created public certificate, the result is as follows:

cosign verify -key cosign.pub registryXYZ.azurecr.io/example-func:1.0.0
using embedded fulcio certificate. did you run `cosign init`? error retrieving target:  missing target metadata: tuf: no root keys found in local meta store
error: no matching signatures:
failed to verify signature
 failed to verify signature

I also exported the key again and tried to reproduce, with the same result:

cosign public-key -key azurekms://ckeyvaultXYZ.azure.net/cosign > cosign-new.pub
cosign verify -key cosign-new.pub registryXYZ.azurecr.io/example-func:1.0.0
using embedded fulcio certificate. did you run `cosign init`? error retrieving target:  missing target metadata: tuf: no root keys found in local meta store
error: no matching signatures:
failed to verify signature
 failed to verify signature

Is there anything I did wrong or is there a bug in the verification? Earlier I added also some comments to #399, when the feature was still under active development.

cosign version
GitVersion:    v1.1.0
GitCommit:     67934a685ddc83aa7b0b8a55c911e299117afac5
GitTreeState:  clean
BuildDate:     '2021-08-25T21:51:14Z'
GoVersion:     go1.17
Compiler:      gc
Platform:      darwin/arm64