Keys are somewhat useless in this scenario. Developers are hacked all the time and not all of them pass phrase their keys. And if someone is going through the e

Keys are somewhat useless in this scenario. Developers are hacked all the time and not all of them pass phrase their keys. And if someone is going through the effort to backflip a popular package via a developer they’d probably keylig the pass phrase too.