@whitequark @ireneista I'm actually in favor of the cool things they've done with sigstore at pypi - it was handled better than at GitHub in some respects.
but I like sigstore in general, the teams mean well. I actually attended an event with the people who implemented it. It's like certificate transparency.