> You can't say that's more correct. That's a prediction about the future that's based on nothing, as far as I can tell. The statement I made is based on what

> You can't say that's more correct. That's a prediction about the future that's based on nothing, as far as I can tell. The statement I made is based on what is currently communicated. The "terms" is purely "you need to use 2FA" (which just to be clear I already said I have no quarrels with). I cannot judge what will be the future requirements will be for critical packages. Donald Stufft from PyPI on Twitter said that he could imagine requiring signed releases (https://twitter.com/dstufft/status/1545503252871004161 https://twitter.com/dstufft/status/1545503252871004161). > I don't get the complication here. Maybe there is none, maybe there is. The consequence however undoubtedly is that if you do not accept the terms you lose access to your package on PyPI.