How is PyPI supposed to tell if the person signing the artifacts is handling their key securely?
replyThey can't. But they can't tell for sure if large tech corporations are doing that either. Data breaches are a thing. Auditing Github workflows doesn't prevent them.
replyMicrosoft can't even figure out how to send email reliably. But sure everyone should trust them with signing packages.
reply