This leaves out the important context that key verification for these packages isn't functional.<p><i>In the last 3 years, about 50k signatures had been uploaded to PyPI by 1069 unique keys. Of those 1069 unique keys, about 30% of them were not discoverable on major public keyservers, making it difficult or impossible to meaningfully verify those signatures. Of the remaining 71%, nearly half of them were unable to be meaningfully verified at the time of the audit (2023-05-19) 2.</i><p>More, recently, on this thread:<p><a href="https://news.ycombinator.com/item?id=41873215">https://news.ycombinator.com/item?id=41873215</a>