Can't we require each package on PyPI and whatever, to have their own public GPG key signed and associated to them? I am not sure of the technical issues one w

Can't we require each package on PyPI and whatever, to have their own public GPG key signed and associated to them? I am not sure of the technical issues one would have to overcome with this. Then if someone does try to creep into your package list with a new GPG key or modifies the content with a new key, it would call attention to this much faster and prevent these kind of situations. Thus; if you trust an author, then add their GPG key to your vault. This will most likely cover multiple packages of the same project, as well as well known groups that provide packages on these infrastructure.