In Sigstore claims, the branch is often part of it, such as in buildsigner uri, or the branch one. We want only partial validation of those in in the enrollment, since in most cases that will be a git tag, which is variable (example: refs/tags/0.x.x).
Something like supporting "^" as a special character at the beginning to signal prefix matching might be a non schema-breaking solution.