H/t to @vEpiphyte who observes (on Slack):

2.1.0 changed to have cosign version output print to stdout instead of stderr. The change happened in this commit:
40dbbd8
Which may come from this kubernetes-sigs/release-utils@v0.7.3...v0.7.4
specifically here
kubernetes-sigs/release-utils#76

Thanks for the detective work!

It would be useful for scripts to be able to rely on this information.
Per our versioning policy, for that to happen we need to:

1. Document the expected STDOUT output of cosign version.
2. Add a test that checks the output and that it's sent to the right stream.

(For a bonus, we could add a cosign version --format=json flag that output this information in a machine-friendly way.)