There's a proposal (disclosure: I co-authored it) to introduce a new signing mechanism based on sigstore. By separating the signing identity from the rubygems.o

There's a proposal (disclosure: I co-authored it) to introduce a new signing mechanism based on sigstore. By separating the signing identity from the rubygems.org identity, it means that compromising the signing identity doesn't enable you to upload and compromising the rubygems.org identity doesn't enable you to sign. You'd need to compromise both. https://github.com/rubygems/rfcs/pull/37 https://github.com/rubygems/rfcs/pull/37