>the key difference in Maven Central is a manual review process Lipstick on the pig, still covered in mud. The key difference is the regular occurrence of mal

>the key difference in Maven Central is a manual review process Lipstick on the pig, still covered in mud. The key difference is the regular occurrence of malware finding its way into PyPi and NPM due to the lack of multilayered security on those repos. You guys keep trying to prop up the straw man that ONLY package signing is needed. It's not. It's a start. Nobody is making that argument but you. You not only repeatedly beat that dead horse, but you carry it to the illogical extreme that package signing is somehow harmful. Not only do you see no value in that layer of security, but you actively resist any talk or attempts at implementing it. Meanwhile, your repo is infested with hackers and malware. Big surprise.