Thanks - agreed, release manager signatures are nice to have. The reason I ask is that I think it'd be nice if third parties could also voluntarily sign releas

Thanks - agreed, release manager signatures are nice to have. The reason I ask is that I think it'd be nice if third parties could also voluntarily sign releases. For example: the author of a library -- or one of their users -- could fund a security audit of a specific version, and then the auditors could sign to attest their findings (issue and severity count, perhaps) in a way that's visible to package users via the command-line and web. It'd add useful information for people trying to select appropriately-secure code, and also help foster a marketplace for open source security code review.