Comment by semi-extrinsic

A very insightful look at package signing, and why it wouldn't actually improve security for PyPI, by Python packaging guru Donald Stufft:

https://caremad.io/2013/07/packaging-signing-not-holy-grail/