The current formats (publish and SLSA provenance) are for attesting publishing and build steps, respectively, but there's nothing stopping PyPI from adding a different, new attestation statement for local builds (something that conveys "I did this locally, and I was this principal (email address) when I did it").
replySo are there any plans for PyPI to do this?
replyIf I understand this correctly the fundamental problem here is what codesigning / pgp solve.
replyAttestations are code-signing. PyPI once supported PGP signatures on uploads, but as since disabled it because (1) only a tiny minority of users ever signed, and (2) many of the signatures and corresponding keys were either functionally insecure or unusable.
replyBoth of these are latent problems when trying to use PGP in packaging ecosystems; the subset of ecosystems that successfully adopt PGP tend to have very different topologies (namely, small rings of trusted...publishers) rather than an "anyone can publish" architecture like PyPI has.