Overall I agree that the matter is more nuanced than my original comment would indicate re requiring 2FA across the platform, I wouldn't be surprised if 2FA re

Overall I agree that the matter is more nuanced than my original comment would indicate re requiring 2FA across the platform, I wouldn't be surprised if 2FA requirements eventually expand to everyone Maybe this could've been opt-in by having a way for projects to require their dependencies be 2FA all the way down. Since the current policy has a bit of a hole: if you're a critical package, are you allowed to depend on a non-critical package? Are you no longer able to add non-critical dependencies?