Comment by progval

> That existing PGP signatures on PyPI serve no security purpose, and that all evidence points to nobody ever attempting to verify them;

Some Debian package maintainers do check them when downloading packages from PyPI. For example, in the .dsc archive for https://packages.debian.org/bullseye/limnoria, debian/upstream/signing-key.asc contains the key used to sign releases of https://pypi.org/project/limnoria/