> Weak and misconstructed keys should cause the packages to fail to upload to PyPI. This is much easier said than done: keys aren’t uploaded to PyPI at all, on

> Weak and misconstructed keys should cause the packages to fail to upload to PyPI. This is much easier said than done: keys aren’t uploaded to PyPI at all, only signatures are. This would imply either (1) requiring users to upload their public key ahead of time, or (2) PyPI trawling public key servers in hopes of finding a matching fingerprint. Neither of these is acceptable from an operational overhead standpoint, and the latter is both insecure (birthday attacks on PGP fingerprints are trivial) and requires participation in a half-dead keyserver ecosystem.