I do for my personal projects (which are public), but also everyone in my company does for work stuff too. (We also require 2FA for all accounts in the org.) I

I do for my personal projects (which are public), but also everyone in my company does for work stuff too. (We also require 2FA for all accounts in the org.) It's important that any builds pushed out to production are from signed sources.