This is a great move. Another I'd love to see is a mechanism to encourage package maintainers to periodically audit who has permission to publish. Sometimes, us

This is a great move. Another I'd love to see is a mechanism to encourage package maintainers to periodically audit who has permission to publish. Sometimes, usually without MFA, accounts that no longer need access get compromised. An easy interface to audit and revoke unneeded access is important.