You are assuming that the contributors are required to use these specific devices. This is incorrect. PyPI is offering free U2F devices to a subset of the affec

You are assuming that the contributors are required to use these specific devices. This is incorrect. PyPI is offering free U2F devices to a subset of the affected developers, but they are free to use their own U2F devices (or a TOTP client) instead. > Oh, and there's still the silly geo-fencing issue The list of countries makes this sound like an export control issue. It's a legal restriction, not a deliberate choice PyPI made.