What is the relationship between witness policies and in-toto layouts?

[hidde-jan]

It seems that witness policies are similar in scope, but not entirely comparable with the layouts as described in the spec.

I am wondering what the relationship between the two is. In that regard, I have a few questions:

• Is is possible to verify in-toto layouts using witness?
• Are witness policies a replacement for in-toto layouts?
• Is the witness cli is meant as a replacement for the python-based in-toto-* programs?

Any help or pointers would be highly appreciated.