I don't think it makes much sense to verify pypi authors. I mean you could verify corporations and universities and that would get you far, but most of the pack

I don't think it makes much sense to verify pypi authors. I mean you could verify corporations and universities and that would get you far, but most of the packages you use are maintained by random people who signed up with a random email address. I think it makes more sense to verify individual releases. There are tools in that space like crev [1], vouch [2], and cargo-vet [3] that facilitate this, allowing you to trust your colleagues or specific people rather than the package authors. This seems like a much more viable solution to scale trust. [1]: https://github.com/crev-dev/crev https://github.com/crev-dev/crev [2]: https://github.com/vouch-dev/vouch https://github.com/vouch-dev/vouch [3]: https://github.com/mozilla/cargo-vet https://github.com/mozilla/cargo-vet