3 ms·

How about a split, so releases can be uploaded by API key, but only published by someone using MFA?