The grade is for the maintainer not the package. It does punish newcomers but that's the point, newcomers cannot be trusted. People don't search for packages di

The grade is for the maintainer not the package. It does punish newcomers but that's the point, newcomers cannot be trusted. People don't search for packages directly on pypi, they find them elsewhere and then use pypi to install it. If you are a new maintainer, you build reputation elsewhere and ask users to ignore the warning on pypi. After say 1k unique downloads and 90 day probation, you move to the next level with a less serious warning. To avoid all that though, you can purchase a code signing certificate and verify your identity (with pypi not just the ca) and even as a new comer there will be no warning for your packages. After observing many such systems my view is that you have to make up your mind and have a rigid and reliable reputation system or have none at all. The middle is the most dangerous place for everyone but I fear open source people like to repeat mistakes and sacrifice the safety of their users for the sake of ideology. Newcomer+ no known reputation+unverified = warn people