I thought this was exposed by npm in package metadata? At the least it can be made a requirement for packages in the case of multiple people with publishing ac

I thought this was exposed by npm in package metadata? At the least it can be made a requirement for packages in the case of multiple people with publishing access that everyone uses 2fa