FTA: “in the coming months maintainers of projects designated as critical, like yourself, will be required to enable two-factor authentication on their account

FTA: “in the coming months maintainers of projects designated as critical, like yourself, will be required to enable two-factor authentication on their account in order to add new releases or otherwise modify a critical project” Or else? Remove a project deemed critical from PyPI? Make it impossible for anybody to upload improvements, keeping whatever bugs are present? It doesn’t look like PyPI has much leverage here.